Splunk Examples: Manipulating Text and Strings
Last updated:Table of Contents
All examples use the tutorial data from Splunk running on a local Splunk version
Field Starts with
Use where with like:
Example: filter rows where field AcctID starts "87":
your-search-criteria
| where AcctID like "87%"
Just use | where together with like
Field Ends with
Again, just use where with like but the "%" character is now on the left:
Example: filter rows where field AcctID ends in "48":
your-search-criteria
| where AcctID like "%48"
Similarly to the previous entry, but now using % on the left
Field contains string
As you would expect, we can also use where with like to match both sides, effectively having a contains behaviour:
Example: filter rows where field AcctID contains the string "94" anywhere:
your-search-criteria
| where AcctID like "%94%"
Blow the dust off your SQL knowledge, you can use it in splunk too!
Substring
Use substr(<field>, <start>, <end>)
Example: Extract the end of the string in field somefield, starting at index 23 (until 99)
your-search-criteria
| eval newfield=substr(somefield, 23, 99)
Substring, split by character
TODO