topic Re: inserting newline, tab into eval-ed field in Splunk Search

inserting newline, tab into eval-ed field

gliptak — Thu, 12 Nov 2020 21:36:09 GMT

Running

| makeresults | eval s="foo\nbar"

displays

foo\nbar

and it is unclear if the variable has a newline or just contains "\n"

Is this the right syntax to insert newline (tab)?

Re: inserting newline, tab into eval-ed field

ITWhisperer — Fri, 13 Nov 2020 08:11:34 GMT

| makeresults | eval s="foo bar"

Re: inserting newline, tab into eval-ed field

gliptak — Fri, 13 Nov 2020 13:07:18 GMT

The gets me part way there. Shift-Enter works for newline. Would you also have a pointer for inserting Tab?

Re: inserting newline, tab into eval-ed field

ITWhisperer — Fri, 13 Nov 2020 13:17:32 GMT

copy and paste from notepad or something like that

Re: inserting newline, tab into eval-ed field

yuanliu — Sat, 26 Jun 2021 07:36:24 GMT

A really neat trick I keep forgetting! To insert literal newline without external editor/copy-n-paste, you can use "ctrl + <enter>" in SPL search editor.