I want to create a subsearch that will abbreviate all but the first 30 characters of the result.

[NanSplk01]

index=replicate category=* action=* Message=*
  [search index=replicate
   | eval Msg=substr(Message,1,30)]
| stats count by action category Msg

| dedup action

This is what I'm trying to do.  The Message field is very large and I only need the first sentence of the Message.  How can I do this?  We want it in a sub-search to show the sub-search function for our users.

This is Splunk Cloud implementation.

[gcusello]

Hi @NanSplk01 ,

why do you want to use the subsearch?

if I correctly understand you need only to truncate the Message field to the first 3 chars, is it correct?

index=replicate category=* action=* Message=*
| eval Msg=substr(Message,1,30)
| stats 
     values(category) AS category 
     values(Msg) AS Msg 
     BY action 

Ciao.

Giuseppe

[richgalloway]

Recall that subsearches run first and replace themselves with their results.  That means the search is looking only for Msg field (which may not exist in the index) values of 30 characters or fewer (longer values are missed without a wildcard).

Perhaps you only need to truncate the Message for display purposes.  If so, drop the subsearch and run the eval as a separate command.