https://community.splunk.com/t5/Splunk-Search/carriage-return-in-transaction-results/m-p/42967#M10103 <P>I am using transaction and sending the result to an external workflow. The combined results from transaction appear one of the other which looks cluttered. Is there a way to make the individual events from transaction to appear as separate lines? I hope I am making sense.</P> <P>Thanks.</P> Thu, 22 Nov 2012 15:55:50 GMT rmurthy 2012-11-22T15:55:50Z https://community.splunk.com/t5/Splunk-Search/carriage-return-in-transaction-results/m-p/42967#M10103 <P>I am using transaction and sending the result to an external workflow. The combined results from transaction appear one of the other which looks cluttered. Is there a way to make the individual events from transaction to appear as separate lines? I hope I am making sense.</P> <P>Thanks.</P> Thu, 22 Nov 2012 15:55:50 GMT https://community.splunk.com/t5/Splunk-Search/carriage-return-in-transaction-results/m-p/42967#M10103 rmurthy 2012-11-22T15:55:50Z https://community.splunk.com/t5/Splunk-Search/carriage-return-in-transaction-results/m-p/42968#M10104 <P>There is a way you can do this with an eval function to insert a new line before the transaction. You will have to paste the new line in as typing it will trigger a search.</P> <PRE><CODE>sourcetype=cisco_esa | eval _raw=_raw+" "| transaction mid icid dcid </CODE></PRE> <P>If you are adding this into a config file add a backslash \ before the newline.</P> Fri, 23 Nov 2012 00:46:26 GMT https://community.splunk.com/t5/Splunk-Search/carriage-return-in-transaction-results/m-p/42968#M10104 BobM 2012-11-23T00:46:26Z https://community.splunk.com/t5/Splunk-Search/carriage-return-in-transaction-results/m-p/42969#M10105 <P>This no longer works in v6.2.</P> Mon, 06 Jul 2015 00:41:04 GMT https://community.splunk.com/t5/Splunk-Search/carriage-return-in-transaction-results/m-p/42969#M10105 woodcock 2015-07-06T00:41:04Z