Skip to main content
Sumo Logic


The Length operator returns the number of characters in a string. You can use it in where clauses or to create new fields.

For example, you could use the Length operator in free text fields where content is arbitrary to find cases where the field has a substantial amount of text using length() > minimum in a query. Or in a case where a long length would be abnormal, you can find these strings quickly using length() > 10000 in a query.


  • length(<field>) [as <field>]


  • If the string is null, it returns 0.
  • The length operator only works on string fields.


Find only short queries.

Use the following query to find queries under 20 characters.

_sourceCategory=apache error
| parse "query: *," as query
| where length(query) <= 20

Count by the length of the query.

Use this query to count results by the length of the query.

_sourceCategory=apache error
| parse "query: *," as query
| length(query) as query_length
| count by query_length
| sort by _count desc