Skip to main content

​
Introduction

The trim function removes all leading and trailing characters from a string that are part of a specified cutset. A cutset is a set of characters, and trim removes any of them if they appear at the beginning or end of the string. Use the trim function when you want to normalize or clean string values by stripping unwanted characters such as quotes, spaces, slashes, or punctuation. It’s useful in log analysis, standardizing OpenTelemetry attributes, or cleaning identifiers in security logs.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, the trim function removes characters from both ends of a string, using a list of characters. APL’s trim works the same way: it uses a cutset of characters, not a regular expression.
... | eval cleaned=trim(field, "-")
In ANSI SQL, TRIM removes whitespace or specified characters from both ends of a string. APL’s trim works similarly, but instead of supporting keywords like BOTH, LEADING, or TRAILING, it uses separate functions: trim for both ends, ltrim for the start, and rtrim for the end. Like SQL, it operates on characters, not regular expressions.
SELECT TRIM(BOTH '-' FROM '--hello--');

​
Usage

​
Syntax

trim(cutset, source)

​
Parameters

NameTypeRequiredDescription
cutsetstring✓The set of characters to remove from both the beginning and end of source.
sourcestring✓The source string to process.

​
Returns

A string with all leading and trailing characters removed that match any character in the cutset.

​
Use case examples

  • Log analysis
  • OpenTelemetry traces
  • Security logs
You can use trim to normalize URLs by removing leading and trailing slashes before grouping.Query
['sample-http-logs']
| extend clean_uri = trim("/", uri)
| summarize count() by clean_uri
Run in PlaygroundOutput
clean_uricount
api/login120
product/details85
cart/add62
This query removes leading and trailing slashes from the uri field so that identical paths group consistently.
⌘I