topic Re: how to do a line breaking after a string in Splunk Search

how to do a line breaking after a string

jip31 — Tue, 04 Jun 2019 11:52:19 GMT

hello

I need to do a line breaking after "%" and after " on a total of "
| eval Perc=round((NbTOUCHNGOCrashByHost/NbIndHost)*100,1). " %" + " on a total of " + NbIndHost + " machines "

could tyou help me please?

Re: how to do a line breaking after a string

martynoconnor — Tue, 04 Jun 2019 12:09:32 GMT

When you say line breaking, do you mean in context of event breaking in props.conf?

Re: how to do a line breaking after a string

harshpatel — Tue, 04 Jun 2019 12:17:12 GMT

Hi @jip31,

You can use rex command as sed mode to add new line character at two points of your string.
try this:

| makeresults count=1 
| eval Perc=round((NbTOUCHNGOCrashByHost/NbIndHost)*100,1). " %" + " on a total of " + NbIndHost + " machines " 
| rex mode=sed field=Perc "s/%/%\n/g" 
| rex mode=sed field=Perc "s/on a total of/on a total of\n/g"

Re: how to do a line breaking after a string

jip31 — Tue, 04 Jun 2019 13:13:15 GMT

I have changed the sentance:
| eval Perc=round((NbTOUCHNGOCrashByHost/NbIndHost)*100,1). " %" + " / " + NbIndHost + " machines "
but it doesnt works

| eval Perc=round((NbMESCrashByHost/NbIndHost)*100,1). " %" + " / " + NbIndHost + " machines "
| rex mode=sed field=Perc "s/%/%\n/g"
| table Perc

an idea please???

Re: how to do a line breaking after a string

harshpatel — Tue, 04 Jun 2019 13:26:10 GMT

Can you tell me what Splunk version you are using? Also, are you displaying this on the dashboard?

Re: how to do a line breaking after a string

jip31 — Tue, 04 Jun 2019 13:30:03 GMT

7.0.1 version

Re: how to do a line breaking after a string

jip31 — Wed, 05 Jun 2019 03:33:07 GMT

Not at all

Re: how to do a line breaking after a string

jip31 — Wed, 05 Jun 2019 03:33:50 GMT

To my mind the rex command is not correct

Re: how to do a line breaking after a string

harshpatel — Wed, 05 Jun 2019 03:38:10 GMT

Can you tell what value you are getting for Per at the end of eval.

Re: how to do a line breaking after a string

MuS — Wed, 05 Jun 2019 03:41:36 GMT

you might want to escape the \\ in the sed regex:

| rex mode=sed field=Perc "s/%/%\\n/g" 
| rex mode=sed field=Perc "s/on a total of/on a total of\\n/g"

cheers, MuS

Re: how to do a line breaking after a string

MuS — Wed, 05 Jun 2019 03:49:08 GMT

it actually works both ways, with or without escaping:

| makeresults 
| eval foo=" need to do a line breaking after % and after \" on a total of \" " 
| rex mode=sed field=foo "s/%/&\n/g" 
| rex mode=sed field=foo "s/on a total of /&\\n/g"

cheers, MuS

Re: how to do a line breaking after a string

jip31 — Wed, 05 Jun 2019 07:11:20 GMT

like i said earlier I have changed the sentance
now I use it :
| eval Perc=round((NbMESCrashByHost/NbIndHost)*100,1). " %" + " / " + NbIndHost + " machines "

but when I m doing | rex mode=sed field=Perc "s/%/%\n/g" there is always no breakdown...

Re: how to do a line breaking after a string

FrankVl — Wed, 05 Jun 2019 08:12:06 GMT

Works fine for me (using exactly the code you posted here): https://imgur.com/VV4Hd2A

Please share a screenshot of your situation.

Re: how to do a line breaking after a string

jip31 — Wed, 30 Sep 2020 00:47:49 GMT

Re: how to do a line breaking after a string

FrankVl — Wed, 05 Jun 2019 11:53:23 GMT

Right, so the issue is in displaying it as a single value. Apparently that viz does not support multiple lines. I indeed get the same result. I'm afraid what you want is not possible then. (or at least not with pure simple xml dashboard functionality).

Re: how to do a line breaking after a string

jip31 — Wed, 05 Jun 2019 14:39:07 GMT

Grrrrrrrrrrrrrr
ok fraanck thanks although