Splunk Search

Flatten transaction

msarro
Builder

Greetings everyone. This is hopefully a pretty simple question - is there a way to "flatten" transactions? After it runs, you end up with a transaction which is a multiline event. What I'd like to do is flatten the lines into a single line of text. For items where there are multiple matching lines, compress them into a single line which is semicolon delimited or something. Any ideas?

Tags (1)
0 Karma

Ayn
Legend

You could replace newline characters using rex:

<yoursearch> | rex field=_raw mode=sed "s/[\r\n]//g"

The default output in the search app will still wrap lines though, so if you want everything unwrapped on one single line one option would be to use table.

<yoursearch> | eval eventtext=_raw | table _time eventtext

(using _raw directly in table does not work).

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...