Skip to main content
The trim_end function removes all trailing occurrences of specified characters from a string. Use this function to clean log data, remove trailing whitespace or punctuation, or standardize string formats by removing unwanted suffixes.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you use rtrim for trailing whitespace. APL’s trim_end provides more flexibility with custom character sets.
| eval cleaned=rtrim(field)
In ANSI SQL, you use RTRIM for trailing characters. APL’s trim_end provides similar functionality.
SELECT RTRIM(field) AS cleaned FROM logs;

Usage

Syntax

trim_end(cutset, text)

Parameters

NameTypeRequiredDescription
cutsetstringYesA string containing characters to remove from the end.
textstringYesThe source string to trim.

Returns

Returns the source string with all trailing characters in the cutset removed.

Use case examples

  • Log analysis
  • OpenTelemetry traces
  • Security logs
Remove trailing slashes and query parameters from URIs for endpoint grouping.Query
['sample-http-logs']
| extend cleaned_uri = trim_end('/?&', uri)
| summarize request_count = count() by cleaned_uri, method
| sort by request_count desc
| limit 10
Run in PlaygroundOutput
cleaned_urimethodrequest_count
/api/usersGET2341
/api/ordersPOST1987
/api/productsGET1654
This query removes trailing slashes and query separator characters from URIs, enabling better endpoint aggregation.
  • trim_start: Removes leading characters. Use this to trim from the beginning instead of the end.
  • trim: Removes both leading and trailing characters. Use this when you need to clean both ends.
  • trim_end_regex: Removes trailing matches using regex. Use this for pattern-based trimming.
  • replace_string: Replaces strings. Use this when you need to remove characters from anywhere, not just the end.