Splunk Search

eval, if, len, substr to produce specific results

noob4now
New Member

So far, I've had success with the following command:
eval Port=if(len(Port)>=22,substr(Port,1,len(Port)-2),Port)
This checks to see if a Sport result is >= 22, then subtracts 2 characters from the end. I get good results but they need to be specific to a particular search result.

The output I'm concerned with specifically is "Ethernet%" and everything else should be left alone by the above statement. I'm sure this is a simple fix, but I can't quite figure out how to put it all togehter...

I'm thinking it should start with:
eval Port=if(Port="Ethernet%" <--- from here, I'm a bit lost on how to put it together with the above statement.

Tags (4)
0 Karma

renjith_nair
Legend

@noob4now,

Try using nested if

| eval Port=if(match(Port,"Ethernet"),if(len(Port)>=22,substr(Port,1,len(Port)-2),Port),Port)
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...