topic Re: How to add a line break to the eval condition? in Splunk Search

How to add a line break to the eval condition?

pavanae — Fri, 31 May 2019 18:19:48 GMT

I have an eval condition as below in my search:

| eval body= username. " user attempted to delete " . activity_count . " logs by performing the below activities " . mvjoin(activity,", ") . " and removed the logs on host " . src

Which gives the result as follows:

X user attempted to delete 2 logs by performing the below activities rm /abc/cg.log, rm -rf /def/gc.log and removed the logs on host Y

Now, how can I add a line break as shown below:

body

X user attempted to delete 2 logs by performing the below activities 
rm /abc/cg.log
rm -rf /def/gc.log
and removed the logs on host Y

Please let me know how to modify my eval condition to get the required result as shown above.

Re: How to add a line break to the eval condition?

aromanauskas — Fri, 31 May 2019 22:26:07 GMT

Simple way to convert the text string to multiple lines is with makemv.

| eval body= username. " user attempted to delete " . activity_count . " logs by performing the below activities :" . mvjoin(activity,": ") . ": and removed the logs on host " . src
| makemv delim=":" body

Re: How to add a line break to the eval condition?

harshpatel — Sat, 01 Jun 2019 07:19:05 GMT

Hi,

You can either go this way mentioned here: https://answers.splunk.com/answers/40033/add-line-breaks-with-eval.html

Or you can simply press shift+enter in the search bar to break line in the string for ex.

| makeresults count=1 
| eval test="hello
world"

Hope this helps.

Re: How to add a line break to the eval condition?

ilyaresh — Mon, 03 Jun 2019 01:18:38 GMT

This is how I did it

| eval Description = 
 "Type: " . sys_type 
. "---System Name: " . sys_name
. "---Name: " . name
. "---Filename Pattern: " . filename_pattern
| rex mode=sed field=Description "s/---/\n/g"

Basically provide some pattern ("---" in my case) that you want to break the lines on and then replace it with "\n" using sed

Re: How to add a line break to the eval condition?

evania — Mon, 17 Jun 2019 21:54:16 GMT

Hi @pavanae ,

Did you have a chance to check out any answers? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help you.

Thanks for posting!

Re: How to add a line break to the eval condition?

PZ — Thu, 23 Nov 2023 06:15:30 GMT

that's exactly what I was after!

thanks mate