topic Replace all newlines anywhere (beginning, middle, end) on field in Splunk Search

Replace all newlines anywhere (beginning, middle, end) on field

dojiepreji — Tue, 11 Feb 2020 07:39:10 GMT

Hello all,

I have a field with data that looks like this:

The process has failed. Please review.

Dear Team

Please assign to Team

Process blah blah to blah blah

Please review logs.

Sincerely

Support

I want to remove all linebreaks like so:

The process has failed. Please review blah: Dear Team Please open a new Incident and assign to Team blah Submitted from 1928389112828 blah. Please review attached logs. Sincerely, Support.

I've tried sed to do it: | rex mode=sed field=description "s/(\n+)//g", but the output still has extra spaces at the beginning.
I've also tried trim(description) but it's giving me the same result.

Any help would be appreciated. Thanks.

Re: Replace all newlines anywhere (beginning, middle, end) on field

manjunathmeti — Tue, 11 Feb 2020 08:55:59 GMT

Use replace.

| makeresults
| eval description = "The process has failed. Please review.

Dear Team

Please assign to Team

Process blah blah to blah blah

Please review logs.

Sincerely

Support"
| eval description = replace(description, "\n\n", "")

Re: Replace all newlines anywhere (beginning, middle, end) on field

dojiepreji — Tue, 11 Feb 2020 09:05:13 GMT

Did not work. Nothing happened to my field.

Re: Replace all newlines anywhere (beginning, middle, end) on field

manjunathmeti — Tue, 11 Feb 2020 09:11:57 GMT

I am getting the proper result. With above query I got below value for description:

The process has failed. Please review. Dear Team Please assign to Team Process blah blah to blah blah Please review logs. Sincerely Support

Re: Replace all newlines anywhere (beginning, middle, end) on field

dojiepreji — Tue, 11 Feb 2020 09:31:28 GMT

There are multiple line breaks before the line The process has failed.... This might be contributing as to why I'm not getting any changes.

Re: Replace all newlines anywhere (beginning, middle, end) on field

wmyersas — Tue, 11 Feb 2020 15:34:47 GMT

You're close - you need to change the regex in replace() from "\n\n" to "[\n\r\f]"

Then replace() will change any form of a newline to a blank.

Alternatively, you could do | eval description=replace(replace(description,"[\n\r\f]"," "),"\s{2,}"," ")
Which will replace newlines with a space, and then replace any sequential whitespace with a single space.

Re: Replace all newlines anywhere (beginning, middle, end) on field

to4kawa — Wed, 12 Feb 2020 12:33:45 GMT

| makeresults 
| eval description="The process has failed. Please review.


Dear Team


Please assign to Team


Process blah blah to blah blah


Please review logs.


Sincerely


Support" 
| eval description=replace(description,"(?m)\s+"," ")

HI, @dojiepreji
try (?m)

cf. regex101