Splunk Search

len(-5d@d)

yasaswinipotta
New Member

I am trying to solve a query and I came across a time modifier with len() function. I did not understand the behavior.

Tags (1)
0 Karma

nickhills
Ultra Champion

I think the short answer is whatever you have come across is wrong.

|eval result=len(-5d@d) will not execute.
However
|eval result=len("-5d@d") will execute and return the value of 5 (as there are 5 characters in that string)

Can you share a link to the material?

If my comment helps, please give it a thumbs up!
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@yasaswinipotta

Can you please share more information of your issue? How you are using len() with time modifier and what is the purpose/requirement OR your sample search?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...