Splunk Search

length of string (Urgent Requirment pls)

harishalipaka
Motivator

HI All.
i want lenght of string with include space ,double quotes everything special charecters.

|eval length=len("East1" or "East1")
|eval lenght2=len("%")
Thanks
Harish
Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi

Can you please try this XML?

<form>
  <label>length of string (Urgent Requirment pls)</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="sourcetype">
      <label>field1</label>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_internal | stats count by sourcetype</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <delimiter>OR</delimiter>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <change>
        <eval token="mytoken">replace($sourcetype$,"OR",".")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        $mytoken$
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>$sourcetype$</title>
        <search>
          <query>| makeresults | eval ppp="".$mytoken$ | eval result=if(len(ppp)=1,"All","Single") | table result ></query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Happy Splunking

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi harishalipaka
len function gives the total lenght of a string:

index=_internal | head 1 | eval ppp="12345 67890" | eval l=len(ppp) | table l
result is 11

if you have special chars you have to use "\" backslash to escape these chars, infact

index=_internal | head 1 | eval ppp="12345 \"67890" | eval l=len(ppp) | table l
result is 12

I don't understand the examples you shared.

Bye.
Giuseppe

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Are you looking for this?

| makeresults |
eval length=len("East1\" or \"East1")
|eval lenght2=len("%")
0 Karma

harishalipaka
Motivator

Hi @kamlesh vaghela ji

Congrats ,

I am feel happy when i saw this message but i dont know how to contact so i wished this way sorry.

2nd karma contest winner announced! Congrats to kamlesh_vaghela for winning the Nov 2017 competition and a free pass to .conf18!
Thanks
Harish
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI @harishalipaka ,
Thank you very much. 🙂
You can find me on splunk slack community. Use this link: splk.it/slack

Thanks

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...