Splunk Search

what is the use of substr in my macro?

pavanae
Builder

I have defined a field extraction in a macro as below

my_search | eval field_A="EventCode: " + EventCode + "; EventType: " + EventType + "; Message: " + substr(Message,1,100)
iseval = 0

What is meant by that? could anyone explain please.

0 Karma
1 Solution

micahkemp
Champion
substr(X,Y,Z)   Returns a substring from X based on the starting position Y and the length Z.

In the search above substr returns the first 100 characters of the Message field.

View solution in original post

cmerriman
Super Champion

The substr command grabs a section of text beginning at the first indicated index number Until the number of characters is reached (second number indicated). In your example, it is grabbing the first 100 characters of the field Message.
http://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/TextFunctions

micahkemp
Champion
substr(X,Y,Z)   Returns a substring from X based on the starting position Y and the length Z.

In the search above substr returns the first 100 characters of the Message field.

Get Updates on the Splunk Community!

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...