Usage of Splunk EVAL Function : LEN

Usage of Splunk EVAL Function : LEN

  • This function returns the count of character in the string.
  • This function takes a single argument X where X is any field name.

Find below the skeleton of the usage of the function “len” with EVAL :

 ….. |  eval New_Field=len(X)

Example :


| eval LENGTH=len(method)

| table method,LENGTH

| dedup method,LENGTH


Result :

method                                                                     LENGTH

GET  3


Explanation : 

In the above Query, “method” is the existing field name in the “_internal” index.

The count of number of characters of each values of the “method” field are assigned to the “LENGTH”.

For example number of characters of “GET” is 3 and “POST” is 4 etc.



Now you can effectively utilize “len” function with “eval” command to meet your requirement !!

Hope you are now comfortable in : Usage of Splunk EVAL Function : LEN





You can also know about :  Usage Of Splunk Eval Function : RTRIM

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.