Try this
Your search..| eval FLOW=if(len(FLOW)=3,null,substr(FLOW,len(FLOW)-2,3))
If you need 3 digits leaving last 3 digits then try this
Your search..| eval FLOW=if(len(FLOW)=3,null,substr(FLOW,len(FLOW)-5,3))
Good to know that it worked...
strive
Thank you for helping me out.
Have a good day ^^
If i understand it right.. you need 3 digits leaving last 3 digits is that right?
You said you need last 3 digits. In that case for 100100135139 last 3 digits are 139 right?
Yes.. I need FLOW value is 135
Thats what you need right. FLOW=139. My answer did not work for you?
um.. Tried..FLOW value is 100100135139 but FLOW=139
I think instead of substr(FLOW,len(FLOW)-2,len(FLOW)) you can just write substr(FLOW,-3), which is basically the same, but might be easier to understand later.
All right !
Ok. you are saying FLOW is a field in log file with possible values as 123, 123456, 123456789 and etc.
Raw logs will be:
FLOW
123
123456
123456789
When you extract, you need
FLOW
null
456
789
Is this right?
Sorry FLOW=789 example.. cancel
You said you only need 3 digit in the end. In that case your second example should be FLOW=456, third example should be FLOW=789 and so on.. right?