How to add a line break to the eval condition?

[pavanae]

I have an eval condition as below in my search:

| eval body= username. " user attempted to delete " . activity_count . " logs by performing the below activities " . mvjoin(activity,", ") . " and removed the logs on host " . src

Which gives the result as follows:

X user attempted to delete 2 logs by performing the below activities rm /abc/cg.log, rm -rf /def/gc.log and removed the logs on host Y

Now, how can I add a line break as shown below:

body

X user attempted to delete 2 logs by performing the below activities 
rm /abc/cg.log
rm -rf /def/gc.log
and removed the logs on host Y

Please let me know how to modify my eval condition to get the required result as shown above.

[evania]

Hi @pavanae ,

Did you have a chance to check out any answers? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help you.

Thanks for posting!

[ilyaresh · Accepted solution]

This is how I did it

| eval Description = 
 "Type: " . sys_type 
. "---System Name: " . sys_name
. "---Name: " . name
. "---Filename Pattern: " . filename_pattern
| rex mode=sed field=Description "s/---/\n/g"

Basically provide some pattern ("---" in my case) that you want to break the lines on and then replace it with "\n" using sed

[PZ]

that's exactly what I was after!

thanks mate

[harshpatel]

Hi,

You can either go this way mentioned here: https://answers.splunk.com/answers/40033/add-line-breaks-with-eval.html

Or you can simply press shift+enter in the search bar to break line in the string for ex.

| makeresults count=1 
| eval test="hello
world"

Hope this helps.

[aromanauskas]

Simple way to convert the text string to multiple lines is with makemv.

| eval body= username. " user attempted to delete " . activity_count . " logs by performing the below activities :" . mvjoin(activity,": ") . ": and removed the logs on host " . src
| makemv delim=":" body