https://community.splunk.com/t5/Getting-Data-In/How-to-replace-line-breaks-with-delimiters/m-p/268876#M51617 <P>try something like this, </P> <PRE><CODE>your base search.... | eval o1=o |nomv o1 | rex mode=sed field=o1 "s/\n/|/g" </CODE></PRE> Thu, 02 Feb 2017 22:19:30 GMT vasanthmss 2017-02-02T22:19:30Z https://community.splunk.com/t5/Getting-Data-In/How-to-replace-line-breaks-with-delimiters/m-p/268872#M51613 <P>I'm trying to replicate other threads that show how to replace line breaks with delimiters. This search is not working. </P> <PRE><CODE>| ldapsearch domain=ED search="(&amp;(objectClass=eduPerson)(weillCornellEduCWID=paa2013))" attrs="weillCornellEduCWID,o" | eval o1 = replace (o, "[\\n\\r]+","|") | eval o2 = replace (o, "[\n\r]","|") | table weillCornellEduCWID, o, o1, o2 </CODE></PRE> <P>Any ideas? See screenshot below.. </P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2409i3B61CE772321D7F5/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 02 Feb 2017 21:17:00 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-replace-line-breaks-with-delimiters/m-p/268872#M51613 paulalbert11 2017-02-02T21:17:00Z https://community.splunk.com/t5/Getting-Data-In/How-to-replace-line-breaks-with-delimiters/m-p/268873#M51614 <P>Does this work?</P> <PRE><CODE>| ldapsearch domain=ED search="(&amp;(objectClass=eduPerson)(weillCornellEduCWID=paa2013))" attrs="weillCornellEduCWID,o" | eval o1 = replace (o, "[\r\n]+","|") | eval o2 = replace (o, "\n","|") | table weillCornellEduCWID, o, o1, o2 </CODE></PRE> Thu, 02 Feb 2017 21:26:08 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-replace-line-breaks-with-delimiters/m-p/268873#M51614 somesoni2 2017-02-02T21:26:08Z https://community.splunk.com/t5/Getting-Data-In/How-to-replace-line-breaks-with-delimiters/m-p/268874#M51615 <P>Thanks for your response, somesoni2. Unfortunately, no. When I run the query, I just get blanks in the o1 and o2 fields.</P> Thu, 02 Feb 2017 21:59:26 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-replace-line-breaks-with-delimiters/m-p/268874#M51615 paulalbert11 2017-02-02T21:59:26Z https://community.splunk.com/t5/Getting-Data-In/How-to-replace-line-breaks-with-delimiters/m-p/268875#M51616 <P>So, if I'm not wrong, the field o is a multivalued field and you just want to make it linear with delimiter as pipe. Is that correct?<BR /> If that is correct, what do you get when you run this?</P> <PRE><CODE>| ldapsearch domain=ED search="(&amp;(objectClass=eduPerson)(weillCornellEduCWID=paa2013))" attrs="weillCornellEduCWID,o" | eval o1 =o | nomv o1 </CODE></PRE> <P>Also, give this a try</P> <PRE><CODE>| ldapsearch domain=ED search="(&amp;(objectClass=eduPerson)(weillCornellEduCWID=paa2013))" attrs="weillCornellEduCWID,o" | eventstats values(o) as o1 delim="|" | nomv o1 </CODE></PRE> Thu, 02 Feb 2017 22:14:47 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-replace-line-breaks-with-delimiters/m-p/268875#M51616 somesoni2 2017-02-02T22:14:47Z https://community.splunk.com/t5/Getting-Data-In/How-to-replace-line-breaks-with-delimiters/m-p/268876#M51617 <P>try something like this, </P> <PRE><CODE>your base search.... | eval o1=o |nomv o1 | rex mode=sed field=o1 "s/\n/|/g" </CODE></PRE> Thu, 02 Feb 2017 22:19:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-replace-line-breaks-with-delimiters/m-p/268876#M51617 vasanthmss 2017-02-02T22:19:30Z https://community.splunk.com/t5/Getting-Data-In/How-to-replace-line-breaks-with-delimiters/m-p/268877#M51618 <P>It works like a charm. Thanks!</P> Thu, 02 Feb 2017 23:03:28 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-replace-line-breaks-with-delimiters/m-p/268877#M51618 paulalbert11 2017-02-02T23:03:28Z https://community.splunk.com/t5/Getting-Data-In/How-to-replace-line-breaks-with-delimiters/m-p/268878#M51619 <P>does exactly what I needed, and much simpler<BR /> than the replace function I was trying to get to work.</P> Wed, 05 Jun 2019 13:55:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-replace-line-breaks-with-delimiters/m-p/268878#M51619 plimpach 2019-06-05T13:55:55Z