Splunk Search

Replace a character with a linebreak in table results

cmak
Contributor

I would like to replace all characters "___" in a certain field with a linebreak in my Table module.

I am currently using the following code

eval n=replace(my_field, "___", "\n")

It does not treat \n as a newline. How do I let Splunk know I want a linebreak

Tags (2)
0 Karma
1 Solution

mmol
Explorer

The links to the 'other' questions/answers do not work anymore.

But what does work is:

| eval n=replace(my__field, "___", "
")

 

 So literally add a newline to your code.

It is silly to need to do it in this way. Why are \n and similar characters as replacements not supported, while they are supported in the pattern. The replace function should also allow other options like replace only one occurrence or all occurrences (learn a bit from the Perl language I guess...)

afreidin
New Member

If this helps anyone, I solved this using a streamstats which always resets:

...
| streamstats reset_before="1=1" list(mvfield) as mvfield
| table mvfield
0 Karma

ZacEsa
Communicator

The second answer here http://splunk-base.splunk.com/answers/41691/add-newline-into-table-cell

Which says use split. That worked for me. Rex mode=sed doesn't work for me.

0 Karma

Ayn
Legend

Thanks, nice catch. Fixed.

0 Karma

cmak
Contributor

Thanks, just as a note, the mvjoin requires the eval statement in front of it.

0 Karma

Ayn
Legend

Indent code blocks with 4 spaces on each line (or click the "1010101" button which does this for you). This will make code show up properly on the site. I fixed this for you this time though.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...