Splunk Search

Substring only the displayed data


The goal here is to let the search filter on the full values but only return a portion (substring) of the "Message" field to the table in the below query.

Often we will have an idea of the event based on the first 100 characters but I need the full messages to be evaluated as truncating them at a search level might cause undesired results.

index=db_apps_digital host=abc* OR host=abc* NOT host=abc NOT host=zxc 
   | spath "Properties.Application" 
   | search "Properties.Application"="app01" OR "Properties.Application"="app02" OR "Properties.Application"="app03"   
   | eval LastEventDateTime=strftime(strptime(LastEventDateTime,"%Y-%m-%dT%H:%M:%S.%N%z") ,"%Y-%m-%d %H:%M:%S")   
   | stats count latest(Timestamp) as LastEventDateTime by Properties.Message, Level, Properties.Application
   | sort -count, Level
   | head 100
   | rename Properties.Application as Application, Properties.Message as Message
0 Karma
1 Solution


| eval Message = substr(Message 1,100)

View solution in original post


| eval Message = substr(Message 1,100)

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...