topic Re: Replace a character with a linebreak in table results in Splunk Search

Replace a character with a linebreak in table results

cmak — Mon, 04 Feb 2013 18:12:46 GMT

I would like to replace all characters "___" in a certain field with a linebreak in my Table module.

I am currently using the following code

eval n=replace(my_field, "___", "\n")

It does not treat \n as a newline. How do I let Splunk know I want a linebreak

Re: Replace a character with a linebreak in table results

Ayn — Mon, 04 Feb 2013 19:18:11 GMT

Indent code blocks with 4 spaces on each line (or click the "1010101" button which does this for you). This will make code show up properly on the site. I fixed this for you this time though.

Re: Replace a character with a linebreak in table results

Ayn — Mon, 04 Feb 2013 19:20:25 GMT

See answers to the following questions:
http://splunk-base.splunk.com/answers/40033/add-line-breaks-with-eval
http://splunk-base.splunk.com/answers/41691/add-newline-into-table-cell

Re: Replace a character with a linebreak in table results

cmak — Mon, 04 Feb 2013 19:39:05 GMT

Thanks, just as a note, the mvjoin requires the eval statement in front of it.

Re: Replace a character with a linebreak in table results

Ayn — Mon, 04 Feb 2013 19:41:14 GMT

Thanks, nice catch. Fixed.

Re: Replace a character with a linebreak in table results

ZacEsa — Wed, 17 Aug 2016 01:09:34 GMT

The second answer here http://splunk-base.splunk.com/answers/41691/add-newline-into-table-cell

Which says use split. That worked for me. Rex mode=sed doesn't work for me.

Re: Replace a character with a linebreak in table results

afreidin — Mon, 02 Oct 2017 20:06:20 GMT

If this helps anyone, I solved this using a streamstats which always resets:

...
| streamstats reset_before="1=1" list(mvfield) as mvfield
| table mvfield

Re: Replace a character with a linebreak in table results

mmol — Tue, 15 Dec 2020 13:58:49 GMT

The links to the 'other' questions/answers do not work anymore.

But what does work is:

| eval n=replace(my__field, "___", " ")

So literally add a newline to your code.

It is silly to need to do it in this way. Why are \n and similar characters as replacements not supported, while they are supported in the pattern. The replace function should also allow other options like replace only one occurrence or all occurrences (learn a bit from the Perl language I guess...)