trim_space
Use trim_space when you need to ensure that extraneous spaces at the beginning or end of a string don’t interfere with your analysis or results.
Usage#
Syntax#
trim_space(value)Parameters#
| Name | Type | Description |
|---|---|---|
| value | string | The input string to trim. |
Returns#
A string with all leading and trailing whitespace removed. The function doesn't modify internal whitespace.
Use case examples#
When analyzing request URIs from logs, trailing or leading spaces can lead to false negatives in equality comparisons. Use trim_space to normalize request paths.
Query
['sample-http-logs']
| extend cleaned_uri = trim_space(uri)
| summarize count() by cleaned_uriOutput
| cleaned_uri | count |
|---|---|
| /api/data | 120 |
| /api/data/submit | 88 |
| /login | 42 |
This query removes leading and trailing spaces from each uri and aggregates request counts by the cleaned path.
In OpenTelemetry traces, service names or span IDs can have unintended spaces when injected from external tools. Use trim_space to standardize span IDs before filtering.
Query
['otel-demo-traces']
| extend clean_span_id = trim_space(span_id)
| summarize count() by clean_span_idOutput
| clean_span_id | count |
|---|---|
| 53c9e2f4e8794a6a | 17 |
| a3ff4f1e5b9d1c22 | 14 |
| 12c4b9f7da984dc7 | 21 |
This query trims each span_id and aggregates span counts, ensuring ID formatting does not affect grouping.
Other query languages#
Splunk SPL users
In Splunk, the trim function removes leading and trailing spaces. APL’s trim_space works similarly.
Splunk example
| eval cleaned_field = trim(uri)APL equivalent
['sample-http-logs']
| extend cleaned_uri = trim_space(uri)ANSI SQL users
In ANSI SQL, the TRIM() function removes leading and trailing whitespace by default. APL’s trim_space achieves the same behavior.
SQL example
SELECT TRIM(uri) AS cleaned_uri FROM sample_http_logsAPL equivalent
['sample-http-logs']
| extend cleaned_uri = trim_space(uri)