How can I extract the first 10 characters of token value in query?

[wu_weidong]

I have the following query statement:

index=users uin="$uin$" | timechart count by uin
The token "uin" came from another search on another index, and is of the format "1234567890abcde" or "1234567890". The "uin" field in the "users" index is only of the 10-digit format. I'm trying to search for a particular "uin" value in the "user" index based on the first 10 characters of whatever the "uin" token value is.

I've seen examples of using the substr function to get the first 10 values of the token value, but how can I use that as part of the search filter? The "user" index is quite big, so I would like to first filter for the particular "uin" before more processing.

[kmaron]

you could create a new token that is the substring of the original and use the new token in your search.

      <change>
        <eval token="uin_short">substr($uin$,0,10)</eval>
      </change>

[kamlesh_vaghela · Accepted solution]

Hi @wu_weidong,

Can you please try following search?

index=users [| makeresults | eval temp="$uin$",uin=substr(temp,0,10) | return uin] | timechart count by uin

Thanks

[wu_weidong]

Thanks! This worked. If you want, you can move it to the Answer section so I can accept it as the answer?

[kamlesh_vaghela]

Hi @wu_weidong,
Please accept the answer.

Happy Splunking