field extract OR substr ?

[khyoung7410]

Field name is FLOW.
FLOW field value is 123 OR 123456 OR 123456789 OR ...

FLOW=123 ===> FLOW=null

FLOW=123456 ===> FLOW=123

FLOW=123456789 ===> FLOW=456

.

.

.

I only need a three-digit in the end.
Help me ....

[strive]

Try this

Your search..| eval FLOW=if(len(FLOW)=3,null,substr(FLOW,len(FLOW)-2,3))

If you need 3 digits leaving last 3 digits then try this

Your search..| eval FLOW=if(len(FLOW)=3,null,substr(FLOW,len(FLOW)-5,3))

[strive]

Good to know that it worked...

[khyoung7410]

strive
Thank you for helping me out.
Have a good day ^^

[strive]

If i understand it right.. you need 3 digits leaving last 3 digits is that right?

[strive]

You said you need last 3 digits. In that case for 100100135139 last 3 digits are 139 right?

[khyoung7410]

Yes.. I need FLOW value is 135

[strive]

Thats what you need right. FLOW=139. My answer did not work for you?

[khyoung7410]

um.. Tried..FLOW value is 100100135139 but FLOW=139

[tom_frotscher]

I think instead of substr(FLOW,len(FLOW)-2,len(FLOW)) you can just write substr(FLOW,-3), which is basically the same, but might be easier to understand later.

[khyoung7410]

All right !

[strive]

Ok. you are saying FLOW is a field in log file with possible values as 123, 123456, 123456789 and etc.
Raw logs will be:
FLOW
123
123456
123456789

When you extract, you need
FLOW
null
456
789

Is this right?

[khyoung7410]

Sorry FLOW=789 example.. cancel

[strive]

You said you only need 3 digit in the end. In that case your second example should be FLOW=456, third example should be FLOW=789 and so on.. right?