Splunk Search

Need string minus last 2 characters

rachelneal
Path Finder

I am trying to set a field to the value of a string without the last 2 digits. For example:

Hotel=297654 from 29765423
Hotel=36345 from 3624502

I tried rtrim but docs say you must know the exact string you're removing, mine are different every time. I also tried substr but the length is not constant from 1st character and using -2 like substr(Field, -2) returns the last 2 characters...the part I want to throw away.

Was trying something like rtrim(Field,substr(Field,-2) but can't get that to work.

Suggestions? - THANKS

Tags (1)
0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

This may do it:

<your_search_here> | eval myfield = substr(myfield, 1, len(myfield)-2)

d.

-
please upvote if you find this answer useful

View solution in original post

_d_
Splunk Employee
Splunk Employee

This may do it:

<your_search_here> | eval myfield = substr(myfield, 1, len(myfield)-2)

d.

-
please upvote if you find this answer useful

Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...