Splunk Search

eval, if, len, substr to produce specific results

noob4now
New Member

So far, I've had success with the following command:
eval Port=if(len(Port)>=22,substr(Port,1,len(Port)-2),Port)
This checks to see if a Sport result is >= 22, then subtracts 2 characters from the end. I get good results but they need to be specific to a particular search result.

The output I'm concerned with specifically is "Ethernet%" and everything else should be left alone by the above statement. I'm sure this is a simple fix, but I can't quite figure out how to put it all togehter...

I'm thinking it should start with:
eval Port=if(Port="Ethernet%" <--- from here, I'm a bit lost on how to put it together with the above statement.

Tags (4)
0 Karma

renjith_nair
Legend

@noob4now,

Try using nested if

| eval Port=if(match(Port,"Ethernet"),if(len(Port)>=22,substr(Port,1,len(Port)-2),Port),Port)
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...