Splunk Search
Highlighted

Limit length of field (# of characters) in search results?

Builder

Hello,

Is there a way to limit the length of a field in a search result to X number of characters?

I.E. return only the first 15 characters of a field in a search result?

The reason I ask is because I have a few dashboard panels with fields that are excessively long and they cause the other fields to be out of view (have to scroll to the right to view them).

Thanks!

Highlighted

Re: Limit length of field (# of characters) in search results?

SplunkTrust
SplunkTrust

You can use eval-substr for the same. example

your search....|eval yourfield=substr(yourfield,1,15)

This will give first 15 character for yourfield's value.

View solution in original post

Highlighted

Re: Limit length of field (# of characters) in search results?

Builder

This works perfectly, thank you!

0 Karma