I have an eval condition as below in my search:
| eval body= username. " user attempted to delete " . activity_count . " logs by performing the below activities " . mvjoin(activity,", ") . " and removed the logs on host " . src
Which gives the result as follows:
X user attempted to delete 2 logs by performing the below activities rm /abc/cg.log, rm -rf /def/gc.log and removed the logs on host Y
Now, how can I add a line break as shown below:
body
X user attempted to delete 2 logs by performing the below activities
rm /abc/cg.log
rm -rf /def/gc.log
and removed the logs on host Y
Please let me know how to modify my eval condition to get the required result as shown above.
This is how I did it
| eval Description =
"Type: " . sys_type
. "---System Name: " . sys_name
. "---Name: " . name
. "---Filename Pattern: " . filename_pattern
| rex mode=sed field=Description "s/---/\n/g"
Basically provide some pattern ("---" in my case) that you want to break the lines on and then replace it with "\n" using sed
Hi @pavanae ,
Did you have a chance to check out any answers? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help you.
Thanks for posting!
This is how I did it
| eval Description =
"Type: " . sys_type
. "---System Name: " . sys_name
. "---Name: " . name
. "---Filename Pattern: " . filename_pattern
| rex mode=sed field=Description "s/---/\n/g"
Basically provide some pattern ("---" in my case) that you want to break the lines on and then replace it with "\n" using sed
that's exactly what I was after!
thanks mate
Hi,
You can either go this way mentioned here: https://answers.splunk.com/answers/40033/add-line-breaks-with-eval.html
Or you can simply press shift+enter in the search bar to break line in the string for ex.
| makeresults count=1
| eval test="hello
world"
Hope this helps.
Simple way to convert the text string to multiple lines is with makemv.
| eval body= username. " user attempted to delete " . activity_count . " logs by performing the below activities :" . mvjoin(activity,": ") . ": and removed the logs on host " . src
| makemv delim=":" body