splunk query with substring not working

[super_edition]

Hello Everyone,

I have written the splunk query to remove last 2 character from the string:

processingDuration = 102ms  as 102 for the following log:

{
	"timestamp": "2029-02-29 07:32:54.734",
	"level": "INFO",
	"thread": "54dd544ff",
	"logger": "my.logger",
	"message": {
		"logTimeStamp": "2029-02-29T07:32:54.734494726Z",
		"logType": "RESP",
		"statusCode": 200,
		"processingDuration": "102ms",
		"headers": {
			"Content-Type": [
				"application/json"
			]
		},
		"tracers": {
			"correlation-id": [
				"hfkjhwkj98342"
			],
			"request-id": [
				"53456345"
			],
			"service-trace-id": [
				"34234623456"
			]
		}
	},
	"context": "hello-service"
}

my splunk query:

index=my_index    
| spath logger | search logger="my.logger" 
| spath "message.logType" | search "message.logType"=RESP 
| spath "message.tracers.correlation-id{}" | search "message.tracers.correlation-id{}"="hfkjhwkj98342" 
| eval myprocessTime = substr("message.processingDuration", 1, len("message.processingDuration")-2)
| table "message.tracers.correlation-id{}" myprocessTime

the above query considers "message.processingDuration" as string itself and removes last 2 characters out of it.

super_edition_1-1723117654225.png

I tried without double quotes also, it returned empty:

substr(message.processingDuration, 1, len(message.processingDuration)-2)

 Appreciate your help on this.

Thanks in advance.

[richgalloway · Accepted solution]

A string in single quotes is treated by Splunk as a field name.

substr('message.processingDuration', 1, len('message.processingDuration')-2)