Splunk Search

Substring only the displayed data

rossboss1989
Engager

The goal here is to let the search filter on the full values but only return a portion (substring) of the "Message" field to the table in the below query.

Often we will have an idea of the event based on the first 100 characters but I need the full messages to be evaluated as truncating them at a search level might cause undesired results.

index=db_apps_digital host=abc* OR host=abc* NOT host=abc NOT host=zxc 
   | spath "Properties.Application" 
   | search "Properties.Application"="app01" OR "Properties.Application"="app02" OR "Properties.Application"="app03"   
   | eval LastEventDateTime=strftime(strptime(LastEventDateTime,"%Y-%m-%dT%H:%M:%S.%N%z") ,"%Y-%m-%d %H:%M:%S")   
   | stats count latest(Timestamp) as LastEventDateTime by Properties.Message, Level, Properties.Application
   | sort -count, Level
   | head 100
   | rename Properties.Application as Application, Properties.Message as Message
0 Karma
1 Solution

valiquet
Contributor

| eval Message = substr(Message 1,100)

View solution in original post

valiquet
Contributor

| eval Message = substr(Message 1,100)

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...