Dear Splunk Community, I'm trying to extract a list of changed fields, but they should only be listed if they have a value.     <mysearch> | eval _raw="DeviceName:" . host ." " . if(len(srcaddr)>0,"PolicySrc:" . srcaddr,"") ." " . if(len(dstaddr)>0,"PolicyDst:" . dstaddr,"") ." " . if(len(service)>0,"PolicySvc:" . service,"") ."     With len>0 I managed to hide the fields that have not changed, but in the results they are still there as a line break, e.g.     DeviceName: test PolicyDst: dest1 PolicySvc svc1     How can I get rid of these line break(s)? ... View more

Hello, I'm new to Splunk and I'm looking for some advice. My search, e.g.     <mysearch> | table attributes     returns a value in the following format: name[test 1]srcintf[int1]dstintf[int2]srcaddr[address1]dstaddr[dest1 dest2]service[svc1 svc2 svc3]comments[test comment here] I would like to split the output into individual fields. The values are within square brackets, i.e. name test 1 srcintf int1 dstintf int2 ...     Many thanks! ... View more