Splunk Search

Replace all newlines anywhere (beginning, middle, end) on field

dojiepreji
Path Finder

Hello all,

I have a field with data that looks like this:

The process has failed. Please review.

Dear Team

Please assign to Team

Process blah blah to blah blah

Please review logs.

Sincerely

Support

I want to remove all linebreaks like so:

The process has failed. Please review blah: Dear Team Please open a new Incident and assign to Team blah Submitted from 1928389112828 blah. Please review attached logs. Sincerely, Support.

I've tried sed to do it: | rex mode=sed field=description "s/(\n+)//g", but the output still has extra spaces at the beginning.
I've also tried trim(description) but it's giving me the same result.

Any help would be appreciated. Thanks.

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval description="The process has failed. Please review.


Dear Team


Please assign to Team


Process blah blah to blah blah


Please review logs.


Sincerely


Support" 
| eval description=replace(description,"(?m)\s+"," ")

HI, @dojiepreji
try (?m)

cf. regex101

0 Karma

manjunathmeti
Champion

Use replace.

| makeresults
| eval description = "The process has failed. Please review.

Dear Team

Please assign to Team

Process blah blah to blah blah

Please review logs.

Sincerely

Support"
| eval description = replace(description, "\n\n", "")

0 Karma

wmyersas
Builder

You're close - you need to change the regex in replace() from "\n\n" to "[\n\r\f]"

Then replace() will change any form of a newline to a blank.

Alternatively, you could do | eval description=replace(replace(description,"[\n\r\f]"," "),"\s{2,}"," ")
Which will replace newlines with a space, and then replace any sequential whitespace with a single space.

0 Karma

dojiepreji
Path Finder

Did not work. Nothing happened to my field.

0 Karma

manjunathmeti
Champion

I am getting the proper result. With above query I got below value for description:

The process has failed. Please review. Dear Team Please assign to Team Process blah blah to blah blah Please review logs. Sincerely Support

0 Karma

dojiepreji
Path Finder

There are multiple line breaks before the line The process has failed.... This might be contributing as to why I'm not getting any changes.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...