Axiom
Overview

trim_end

Usage#

Syntax#

trim_end(cutset, text)

Parameters#

Name Type Required Description
cutset string Yes A string containing characters to remove from the end.
text string Yes The source string to trim.

Returns#

Returns the source string with all trailing characters in the cutset removed.

Use case examples#

Remove trailing slashes and query parameters from URIs for endpoint grouping.

Query

['sample-http-logs']
| extend cleaned_uri = trim_end('/?&', uri)
| summarize request_count = count() by cleaned_uri, method
| sort by request_count desc
| limit 10

Run in Playground

Output

cleaned_uri method request_count
/api/users GET 2341
/api/orders POST 1987
/api/products GET 1654

This query removes trailing slashes and query separator characters from URIs, enabling better endpoint aggregation.

Clean trailing characters from service names for consistent grouping.

Query

['otel-demo-traces']
| extend cleaned_service = trim_end('-_', ['service.name'])
| summarize span_count = count() by cleaned_service
| sort by span_count desc
| limit 10

Run in Playground

Output

cleaned_service span_count
frontend 4532
checkout 3421
cart 2987

This query removes trailing hyphens and underscores from service names, standardizing naming conventions for analysis.

Clean trailing punctuation from user identifiers in security logs.

Query

['sample-http-logs']
| extend cleaned_id = trim_end('.,;!?', id)
| summarize attempts = count() by cleaned_id, status
| sort by attempts desc
| limit 10

Run in Playground

Output

cleaned_id status failed_attempts
user123 401 45
admin 403 32

This query removes trailing punctuation from user IDs in authentication attempts, ensuring accurate counting when IDs have inconsistent formatting.

  • trim_start: Removes leading characters. Use this to trim from the beginning instead of the end.
  • trim: Removes both leading and trailing characters. Use this when you need to clean both ends.
  • trim_end_regex: Removes trailing matches using regex. Use this for pattern-based trimming.
  • replace_string: Replaces strings. Use this when you need to remove characters from anywhere, not just the end.

Other query languages#

Splunk SPL users

In Splunk SPL, you use rtrim for trailing whitespace. APL's trim_end provides more flexibility with custom character sets.

Splunk example

| eval cleaned=rtrim(field)

APL equivalent

['sample-http-logs']
| extend cleaned = trim_end(' ', field)
ANSI SQL users

In ANSI SQL, you use RTRIM for trailing characters. APL's trim_end provides similar functionality.

SQL example

SELECT RTRIM(field) AS cleaned FROM logs;

APL equivalent

['sample-http-logs']
| extend cleaned = trim_end(' ', field)

Updated

Was this page helpful?