Splunk Search

Replace all newlines anywhere (beginning, middle, end) on field

dojiepreji
Path Finder

Hello all,

I have a field with data that looks like this:

The process has failed. Please review.

Dear Team

Please assign to Team

Process blah blah to blah blah

Please review logs.

Sincerely

Support

I want to remove all linebreaks like so:

The process has failed. Please review blah: Dear Team Please open a new Incident and assign to Team blah Submitted from 1928389112828 blah. Please review attached logs. Sincerely, Support.

I've tried sed to do it: | rex mode=sed field=description "s/(\n+)//g", but the output still has extra spaces at the beginning.
I've also tried trim(description) but it's giving me the same result.

Any help would be appreciated. Thanks.

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval description="The process has failed. Please review.


Dear Team


Please assign to Team


Process blah blah to blah blah


Please review logs.


Sincerely


Support" 
| eval description=replace(description,"(?m)\s+"," ")

HI, @dojiepreji
try (?m)

cf. regex101

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Use replace.

| makeresults
| eval description = "The process has failed. Please review.

Dear Team

Please assign to Team

Process blah blah to blah blah

Please review logs.

Sincerely

Support"
| eval description = replace(description, "\n\n", "")

0 Karma

wmyersas
Builder

You're close - you need to change the regex in replace() from "\n\n" to "[\n\r\f]"

Then replace() will change any form of a newline to a blank.

Alternatively, you could do | eval description=replace(replace(description,"[\n\r\f]"," "),"\s{2,}"," ")
Which will replace newlines with a space, and then replace any sequential whitespace with a single space.

0 Karma

dojiepreji
Path Finder

Did not work. Nothing happened to my field.

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

I am getting the proper result. With above query I got below value for description:

The process has failed. Please review. Dear Team Please assign to Team Process blah blah to blah blah Please review logs. Sincerely Support

0 Karma

dojiepreji
Path Finder

There are multiple line breaks before the line The process has failed.... This might be contributing as to why I'm not getting any changes.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...