String Operations
len
Description: Takes a string as input and returns its length.
In the example, res will have the value 3, and res1 will have the value 2.
... | eval res=len("foo"), res1=len(12)
lower
Description: Takes a string as input and returns it in lowercase.
In the example, res will have the value "foo", and res1 will have the value "foo".
... | eval res=lower("FOO"), res1=lower("foO")
ltrim
Description: Takes a string and a pattern to look for, removing the pattern from the left side of the string.
In the example, res will have the value abcZZ.
... | eval x=ltrim(" ZZZZabcZZ ", " Z")
replace
Description: Takes a string, a pattern to find, and a replacement value, replacing all occurrences of the pattern.
The second and third arguments can be not only string literals, but also fields or expressions, including concatenation.
In the example, res had the value hello wolrd, but after the command, res will have the value GoodBye wolrd.
... | eval res=replace(res,"hello","GoodBye")
This example masks a sensitive value: the session ID stored in the session_id field of the same event is removed from the value of the url field and replaced with "***".
For example, if url is "/login?session_id=abc123" and session_id is "abc123", then after the command is executed, url_masked will contain "/login?session_id=***".
... | eval url_masked=replace(url, session_id, "***")
rtrim
Description: Takes a string and a pattern to look for, removing the pattern from the right side of the string.
In the example, res will have the value "ZZZZabc".
... | eval x=rtrim("ZZZZabcZZ", "Z")
spath
Description: Searches through a JSON string and returns the value of a specified parameter.
... | eval res=spath(raw_event, "sourcetype")
substr
Description: Takes a string, a start position (optional), and an end position, and returns the corresponding substring.
In the example, res will have the value string.
... | eval res=(substr("string", 1, 3) + substr("string", -3))
trim
Description: Takes a string and a pattern to find, and removes the pattern from the string.
In the example, res will have the value abc.
... | eval res=trim(" ZZZZabcZZ ", " Z")
upper
Description: Takes a string as input and returns it in uppercase.
In the example, res will have the value FOO, and res1 will have the value FOO.
... | eval res=upper("FOO"), res1=upper("foO")
urldecode
Description: Takes a URL-encoded string and returns it in a readable format.
In the example, res will have the value https://saf-systems.com/download?r=header.
... | eval res=urldecode("httsp%3A%2F%2Fsaf-systems.com%2Fdownload%3Fr%3Dheader")
urlencode
Description: Encodes a string for use in a URL by replacing special characters with their escape sequences. This is the inverse operation of urldecode.
In the example, res will be assigned the value httsp%3A%2F%2Fsaf-systems.com%2Fdownload%3Fr%3Dheade.
... | eval res=urlencode("https://saf-systems.com/download?r=header")