The trim_end function removes all trailing occurrences of specified characters from a string. Use this function to clean log data, remove trailing whitespace or punctuation, or standardize string formats by removing unwanted suffixes.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you use rtrim for trailing whitespace. APL's trim_end provides more flexibility with custom character sets.
['sample-http-logs']
| extend cleaned = trim_end(' ', field)In ANSI SQL, you use RTRIM for trailing characters. APL's trim_end provides similar functionality.
['sample-http-logs']
| extend cleaned = trim_end(' ', field)Usage
Syntax
trim_end(cutset, text)Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| cutset | string | Yes | A string containing characters to remove from the end. |
| text | string | Yes | The source string to trim. |
Returns
Returns the source string with all trailing characters in the cutset removed.
Use case examples
Remove trailing slashes and query parameters from URIs for endpoint grouping.
Query
['sample-http-logs']
| extend cleaned_uri = trim_end('/?&', uri)
| summarize request_count = count() by cleaned_uri, method
| sort by request_count desc
| limit 10Output
| cleaned_uri | method | request_count |
|---|---|---|
| /api/users | GET | 2341 |
| /api/orders | POST | 1987 |
| /api/products | GET | 1654 |
This query removes trailing slashes and query separator characters from URIs, enabling better endpoint aggregation.
Clean trailing characters from service names for consistent grouping.
Query
['otel-demo-traces']
| extend cleaned_service = trim_end('-_', ['service.name'])
| summarize span_count = count() by cleaned_service
| sort by span_count desc
| limit 10Output
| cleaned_service | span_count |
|---|---|
| frontend | 4532 |
| checkout | 3421 |
| cart | 2987 |
This query removes trailing hyphens and underscores from service names, standardizing naming conventions for analysis.
Clean trailing punctuation from user identifiers in security logs.
Query
['sample-http-logs']
| extend cleaned_id = trim_end('.,;!?', id)
| summarize attempts = count() by cleaned_id, status
| sort by attempts desc
| limit 10Output
| cleaned_id | status | failed_attempts |
|---|---|---|
| user123 | 401 | 45 |
| admin | 403 | 32 |
This query removes trailing punctuation from user IDs in authentication attempts, ensuring accurate counting when IDs have inconsistent formatting.
List of related functions
- trim_start: Removes leading characters. Use this to trim from the beginning instead of the end.
- trim: Removes both leading and trailing characters. Use this when you need to clean both ends.
- trim_end_regex: Removes trailing matches using regex. Use this for pattern-based trimming.
- replace_string: Replaces strings. Use this when you need to remove characters from anywhere, not just the end.