Splunk Search

How to get the first 20 characters of a field value in Splunk

bhuvanabala
New Member

Hi Team,

  1. I have two fields called Message and Solution. Value of the Solution field is a link which i have defined that in workflow.
  2. on clicking the solution it should get the first 20 characters of the Mesage field value ie. i have defined as http://xxxx:8000/XXX? form.errordesc=$Message$.Substring(0,20) in workflow.
  3. But when i click on solution link i get the message value along with .Substring(0,20) ie. "hello.substring(0,20)" in Dashbaord input field

Please help me how to define substring in workflow URL

Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI @bhuvanabala,

Have you tried to eval new field short_message in props.conf and use it in workflow action URL?

EVAL-ShortMessage= substr(Message,1,20)

Use this eval field in URL:

http://xxxx:8000/XXX? form.errordesc=$ShortMessage$

Thanks

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI @bhuvanabala,

Have you tried to eval new field short_message in props.conf and use it in workflow action URL?

EVAL-ShortMessage= substr(Message,1,20)

Use this eval field in URL:

http://xxxx:8000/XXX? form.errordesc=$ShortMessage$

Thanks

bhuvanabala
New Member

Thanks it worked for me

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...