Splunk Search

How to remove part of my value to create a new value?


Hi guys,

My goal is to remove part of my value to create a new value.

For example, I have a field called created_time = 1517789420.357994. Does anyone know a way of getting newCreatedTime = 1517789420?

I basically just want the .* to go away!

Any help would be appreciated.


0 Karma
1 Solution

| eval newCreatedTime=floor(created_time)

View solution in original post

Super Champion

@micahkemp 's answer is great, you could also try |eval newCreatedTime =mvindex(split(created_time,"."),0) I only mention this in case you ever need to split a field that isn't numeric. http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/MultivalueEvalFunctions

0 Karma

| eval newCreatedTime=floor(created_time)
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...