Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: field extract OR substr ?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
field extract OR substr ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this
Your search..| eval FLOW=if(len(FLOW)=3,null,substr(FLOW,len(FLOW)-2,3))
If you need 3 digits leaving last 3 digits then try this
Your search..| eval FLOW=if(len(FLOW)=3,null,substr(FLOW,len(FLOW)-5,3))
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Good to know that it worked...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
strive
Thank you for helping me out.
Have a good day ^^
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If i understand it right.. you need 3 digits leaving last 3 digits is that right?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You said you need last 3 digits. In that case for 100100135139 last 3 digits are 139 right?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes.. I need FLOW value is 135
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thats what you need right. FLOW=139. My answer did not work for you?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
um.. Tried..FLOW value is 100100135139 but FLOW=139
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think instead of substr(FLOW,len(FLOW)-2,len(FLOW)) you can just write substr(FLOW,-3), which is basically the same, but might be easier to understand later.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
All right !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok. you are saying FLOW is a field in log file with possible values as 123, 123456, 123456789 and etc.
Raw logs will be:
FLOW
123
123456
123456789
When you extract, you need
FLOW
null
456
789
Is this right?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry FLOW=789 example.. cancel
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You said you only need 3 digit in the end. In that case your second example should be FLOW=456, third example should be FLOW=789 and so on.. right?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...
Event Series: Mastering AI Tokenomics and Splunk Agent Observability
span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services
