Splunk Search

How to add a line break to the eval condition?

pavanae
Builder

I have an eval condition as below in my search:

| eval body= username. " user attempted to delete " . activity_count . " logs by performing the below activities " . mvjoin(activity,", ") . " and removed the logs on host " . src

Which gives the result as follows:

X user attempted to delete 2 logs by performing the below activities rm /abc/cg.log, rm -rf /def/gc.log and removed the logs on host Y

Now, how can I add a line break as shown below:

body

X user attempted to delete 2 logs by performing the below activities 
rm /abc/cg.log
rm -rf /def/gc.log
and removed the logs on host Y

Please let me know how to modify my eval condition to get the required result as shown above.

0 Karma
1 Solution

ilyaresh
Path Finder

This is how I did it

| eval Description = 
 "Type: " . sys_type 
. "---System Name: " . sys_name
. "---Name: " . name
. "---Filename Pattern: " . filename_pattern
| rex mode=sed field=Description "s/---/\n/g"

Basically provide some pattern ("---" in my case) that you want to break the lines on and then replace it with "\n" using sed

View solution in original post

evania
Splunk Employee
Splunk Employee

Hi @pavanae ,

Did you have a chance to check out any answers? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help you.

Thanks for posting!

0 Karma

ilyaresh
Path Finder

This is how I did it

| eval Description = 
 "Type: " . sys_type 
. "---System Name: " . sys_name
. "---Name: " . name
. "---Filename Pattern: " . filename_pattern
| rex mode=sed field=Description "s/---/\n/g"

Basically provide some pattern ("---" in my case) that you want to break the lines on and then replace it with "\n" using sed

PZ
Engager

that's exactly what I was after!

thanks mate

0 Karma

harshpatel
Contributor

Hi,

You can either go this way mentioned here: https://answers.splunk.com/answers/40033/add-line-breaks-with-eval.html

Or you can simply press shift+enter in the search bar to break line in the string for ex.

| makeresults count=1 
| eval test="hello
world"

Hope this helps.

0 Karma

aromanauskas
Path Finder

Simple way to convert the text string to multiple lines is with makemv.

| eval body= username. " user attempted to delete " . activity_count . " logs by performing the below activities :" . mvjoin(activity,": ") . ": and removed the logs on host " . src
| makemv delim=":" body

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...