Skip to main content
The trim_start function removes all leading occurrences of specified characters from a string. Use this function to clean log data, remove leading whitespace or special characters, or standardize string formats by removing unwanted prefixes.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you use ltrim for leading whitespace. APL’s trim_start provides more flexibility with custom character sets.
| eval cleaned=ltrim(field)
In ANSI SQL, you use LTRIM for leading characters. APL’s trim_start provides similar functionality.
SELECT LTRIM(field) AS cleaned FROM logs;

Usage

Syntax

trim_start(cutset, text)

Parameters

NameTypeRequiredDescription
cutsetstringYesA string containing characters to remove from the beginning.
textstringYesThe source string to trim.

Returns

Returns the source string with all leading characters in the cutset removed.

Use case examples

  • Log analysis
  • OpenTelemetry traces
  • Security logs
Remove leading slashes from URIs for consistent path analysis.Query
['sample-http-logs']
| extend cleaned_uri = trim_start('/', uri)
| summarize request_count = count() by cleaned_uri, method
| sort by request_count desc
| limit 10
Run in PlaygroundOutput
cleaned_urimethodrequest_count
api/usersGET2341
api/ordersPOST1987
api/productsGET1654
This query removes leading slashes from URIs, standardizing path formats for consistent grouping and analysis.
  • trim_end: Removes trailing characters. Use this to trim from the end instead of the beginning.
  • trim: Removes both leading and trailing characters. Use this when you need to clean both ends.
  • trim_start_regex: Removes leading matches using regex. Use this for pattern-based trimming.
  • replace_string: Replaces strings. Use this when you need to remove characters from anywhere, not just the start.