topic Re: do we have commad to trim new lines ?? in Splunk Search

do we have commad to trim new lines ??

rakesh_498115 — Tue, 19 Feb 2013 10:00:04 GMT

HI..

I have seen the functions ltrim and rtrim to spaces ..do we have functions to trim new lines..

actually in my fields i am getting data like this..

Field

data

so when i use table command to display...

sourcetype="mydata" | table Field

its displaying like this

Field
data

but when i extract it to a csv file ..those empty line spaces are coming...tried coaselce function also.but no luck...

pls help

martin_mueller — Tue, 19 Feb 2013 10:16:26 GMT

Replace should be able to do this, with an expression like this: "[\n\r]+$"

Ayn — Tue, 19 Feb 2013 10:18:10 GMT

...or rex mode=sed. I think replace only replaces once.

martin_mueller — Tue, 19 Feb 2013 10:21:01 GMT

Once should be enough, there's no point in removing trailing newlines again after the first eval.

rakesh_498115 — Tue, 19 Feb 2013 11:30:42 GMT

i have used replace function like this ..

eval Field = replace(Field,"[\n\r]+$","") .. but this didnt work ..

martin_mueller — Tue, 19 Feb 2013 11:55:28 GMT

Works well over here. Make sure there aren't any spaces or other characters after the newlines, else the expression will not match.

As a test, consider removing the dollar sign - that should remove every newline from your field, even non-trailing ones.

rakesh_498115 — Wed, 20 Feb 2013 08:19:36 GMT

even sed command is not working ...

rex field=Field mode=sed "s/^$//"

pls help

Ayn — Wed, 20 Feb 2013 09:01:37 GMT

I'm pretty sure you can't match on anchors like that in regex. You'd need to match against the actual characters, like

rex field=Field mode=sed "s/[\r\n]//g"

rakesh_498115 — Wed, 20 Feb 2013 14:31:13 GMT

Thanx a lot Ayn ..sed is working now 🙂