Tell me, what should I do in my case, I need from the field: 1.SAPS-SIS.TO.LSP.SEND, or: "12.SAPS-SIS.TO.LSP.RECEIVE Get field: "routepointIDnum": "1" or "routepointIDnum": "12" I tried like this and it almost works: index="main" sourcetype="testsystem-script333" | eval routepointID_num=substr(routepointID,1,2) | table routepointID_num Almost because I get: "routepointIDnum": "1." or "routepointIDnum": "12" And I need: "routepointIDnum": "1" or "routepointIDnum": "12" ... View more