Getting Data In

How to truncate a field or limit a field value

ethanthomas
Path Finder

I have  a field called org_name in the data as below 

Org_name="davidcareerhome"

Org_name ="Ethanfurniture"

I want to limit the Org_name only for the first three bytes as below 

Org_name="dav"

Org_name="Eth"

Can someone help me with this and how to do make this change in props.conf and the regex for the same ?

Labels (1)

richgalloway
SplunkTrust
SplunkTrust

Use the substr function.

... | eval Org_name=substr(Org_name, 1, 3)

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...