Hi
How to add the line break in the eval function
base search|eval new = src_host+","+"Event Code="+EventCode+","+"Sub-Code="+code+","+"Reason="+Reason+","|makemv new delim=","
Output:
Server1
Event Code=4625
Sub-Code=0xC0000234
Reason=Account locked out.
server2
Event Code=4771
Sub-Code=0x12
Reason=NULL
What I need:
Server1
Event Code=4625
Sub-Code=0xC0000234
Reason=Account locked out.
server2
Event Code=4771
Sub-Code=0x12
Reason=NULL
Have you tried
base search|eval new = src_host+","+"Event Code="+EventCode+","+"Sub-Code="+code+","+"Reason="+Reason+",\n,"|makemv new delim=","
I tried this, this is the result I got instead of empty line.
Server1
Event Code=4625
Sub-Code=0xC0000234
Reason=Account locked out.
\n
server2
Event Code=4771
Sub-Code=0x12
Reason=NULL
\n
server3
Event Code=4771
Sub-Code=0x18
Reason=NULL
\n
Based on those results, I suggest this. Note the two commas following the Reason field.
base search|eval new = src_host+","+"Event Code="+EventCode+","+"Sub-Code="+code+","+"Reason="+Reason+",,"|makemv new delim=","