trim_end

This page explains how to use the trim_end function in APL.

The trim_end function removes all trailing occurrences of specified characters from a string. Use this function to clean log data, remove trailing whitespace or punctuation, or standardize string formats by removing unwanted suffixes.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk SPL, you use rtrim for trailing whitespace. APL’s trim_end provides more flexibility with custom character sets.

Splunk example

| eval cleaned=rtrim(field)

['sample-http-logs']
| extend cleaned = trim_end(' ', field)

ANSI SQL users

In ANSI SQL, you use RTRIM for trailing characters. APL’s trim_end provides similar functionality.

SQL example

SELECT RTRIM(field) AS cleaned FROM logs;

['sample-http-logs']
| extend cleaned = trim_end(' ', field)

Usage

Syntax

trim_end(cutset, text)

Parameters

Name	Type	Required	Description
cutset	string	Yes	A string containing characters to remove from the end.
text	string	Yes	The source string to trim.

Returns

Returns the source string with all trailing characters in the cutset removed.

Use case examples

Log analysis

Remove trailing slashes and query parameters from URIs for endpoint grouping.

Query

['sample-http-logs']
| extend cleaned_uri = trim_end('/?&', uri)
| summarize request_count = count() by cleaned_uri, method
| sort by request_count desc
| limit 10

Run in Playground

Output

cleaned_uri	method	request_count
/api/users	GET	2341
/api/orders	POST	1987
/api/products	GET	1654

This query removes trailing slashes and query separator characters from URIs, enabling better endpoint aggregation.

OpenTelemetry traces

Clean trailing characters from service names for consistent grouping.

Query

['otel-demo-traces']
| extend cleaned_service = trim_end('-_', ['service.name'])
| summarize span_count = count() by cleaned_service
| sort by span_count desc
| limit 10

Run in Playground

Output

cleaned_service	span_count
frontend	4532
checkout	3421
cart	2987

This query removes trailing hyphens and underscores from service names, standardizing naming conventions for analysis.

Security logs

Clean trailing punctuation from user identifiers in security logs.

Query

['sample-http-logs']
| extend cleaned_id = trim_end('.,;!?', id)
| summarize attempts = count() by cleaned_id, status
| sort by attempts desc
| limit 10

Run in Playground

Output

cleaned_id	status	failed_attempts
user123	401	45
admin	403	32

This query removes trailing punctuation from user IDs in authentication attempts, ensuring accurate counting when IDs have inconsistent formatting.

List of related functions

• trim_start: Removes leading characters. Use this to trim from the beginning instead of the end.
• trim: Removes both leading and trailing characters. Use this when you need to clean both ends.
• trim_end_regex: Removes trailing matches using regex. Use this for pattern-based trimming.
• replace_string: Replaces strings. Use this when you need to remove characters from anywhere, not just the end.