topic Re: Code Sample does not work well. in Splunk Search

Code Sample does not work well.

to4kawa — Fri, 06 Mar 2020 11:31:25 GMT

| makeresults
| eval _raw="Source1_field2,Count
dev,6
prod,5
uat,7
qa,8"
| multikv forceheader=1
| table Source1_field2,Count
| rename COMMENT as "this is sample your stats output"
| transpose 0 header_field=Source1_field2
| eval "prod + uat"=prod+uat
| fields - prod uat
| transpose 0 column_name="Source1_field2" header_field=column

this code works. but code sample add extra space.
copy and paste to search , this is not works.
What should I do?

    Source1_field2  Count
    dev 6
    qa  8
    prod + uat  12
This is correct result.

Re: Code Sample does not work well.

jpolvino — Fri, 06 Mar 2020 12:49:18 GMT

I copied and pasted your sample, which has a leading space on every line, and it works in my Splunk. I did notice that the first line says | makeresults (with a leading space) but when I hit the search button, Splunk auto-removed just that line's leading space, left the others with a leading space, and ran fine.

My browser is Vivaldi 2.10.1745.27 (Stable channel) (64-bit) and Splunk Enterprise is 7.2.8.

Output:
Source1_field2 Count
dev 6
prod 5
uat 7
qa 8

Re: Code Sample does not work well.

efavreau — Fri, 06 Mar 2020 13:16:20 GMT

@to4kawa Code sample is a readability feature here and in other places. Anytime I copy code from anywhere, I paste it into Splunk, then press control+shift+f, which is a Splunk shortcut for pretty formatting. This addresses readability and to your issue, removes the extra spaces. It allows me to read through the code before I submit it to my Splunk. I think this practice will address your issue.

Re: Code Sample does not work well.

to4kawa — Fri, 06 Mar 2020 14:12:52 GMT

thanks for reply @jpolvino
my question is updated.
please confirm.

Re: Code Sample does not work well.

to4kawa — Fri, 06 Mar 2020 14:15:48 GMT

HI, @efavreau
my question is updated.
If your results is correct, please tell me your browser.
I use ⌘+⇧ +F ,too.

Re: Code Sample does not work well.

woodcock — Fri, 06 Mar 2020 19:21:28 GMT

I agree that this is annoying. I wish that there was a a way to either:
Display code sample in such a way that when copying from browser, the leading spaces are not there OR
Have a copy code sample button/option in answers so that it removes the spaces required to for markdown to do code sample.
You should create such a request here:
https://ideas.splunk.com

Re: Code Sample does not work well.

to4kawa — Fri, 06 Mar 2020 21:46:01 GMT

thanks @woodcock
I asked in Splunk>docs.
This question is created to explain to Splunk.
At present, the CSS of tag <pre></pre> and Code Sample is list notation.
so, extra space is added, I think.

Splunk Ideas
In the Splunk Ideas portal, you can search for, vote on, and request new enhancements (called an idea) for any of the Splunk solutions. Splunk Ideas replaces the need to log a P4 enhancement request ticket with Splunk Support.

I don't think this question is new enhancements . This is just the issue.

Re: Code Sample does not work well.

woodcock — Fri, 06 Mar 2020 22:41:34 GMT

That does the same (wrong) thing.

Re: Code Sample does not work well.

efavreau — Fri, 06 Mar 2020 23:30:55 GMT

I'm not able to get your code to result in your answer through manipulating format. When you say it works that way, I have no way of continuing to help.

Re: Code Sample does not work well.

to4kawa — Fri, 06 Mar 2020 23:53:32 GMT

workaround:

not use code sample
use rex mode=sed before multikv and trim leading spaces. e.g. | rex mode=sed "s/(?m)^\s//g"

Till the issue is fixed, I recommend No.2 solution.

Re: Code Sample does not work well.

to4kawa — Fri, 06 Mar 2020 23:53:33 GMT

sample:(use <pre></pre> )

 | makeresults
 | eval _raw="Source1_field2,Count
 dev,6
 prod,5
 uat,7
 qa,8"
 | multikv forceheader=1
 | table Source1_field2,Count
 | rename COMMENT as "this is sample your stats output"
 | transpose 0 header_field=Source1_field2
 | eval "prod + uat"=prod+uat
 | fields - prod uat
 | transpose 0 column_name="Source1_field2" header_field=column

Re: Code Sample does not work well.

to4kawa — Fri, 06 Mar 2020 23:53:34 GMT

sample:( <pre></pre> in comment )

| makeresults
| eval _raw="Source1_field2,Count
dev,6
prod,5
uat,7
qa,8"
| multikv forceheader=1
| table Source1_field2,Count
| rename COMMENT as "this is sample your stats output"
| transpose 0 header_field=Source1_field2
| eval "prod + uat"=prod+uat
| fields - prod uat
| transpose 0 column_name="Source1_field2" header_field=column

Re: Code Sample does not work well.

woodcock — Fri, 06 Mar 2020 23:53:34 GMT

Same thing. It forces a leading space between the line number and the code so that when selected/cut/pasted, it doesn't work right. And no, CTRL-whatever does not fix it because the reformatting ignores spaces inside if double-quotes (as it should).

Re: Code Sample does not work well.

niketn — Sat, 07 Mar 2020 13:33:18 GMT

@to4kawa @woodcock this is not a behavior of Splunk, this is a behavior or html table so I dont think issue fix would be there in Splunk.

Refer to this bare-minimal pure html table which still adds whitespace after each cell values. Save as <yourHTMLFileName>.html and open in any browser. When you perform select all you will notice extra space against each values.

<html>
   <body>
      <table>
         <thead>
            <tr>
               <th><a href="#">sourcetype</a></th>
               <th><a href="#">count</a></th>
            </tr>
         </thead>
         <tbody>
            <tr>
               <td>mongod</td>
               <td>130</td>
            </tr>
            <tr>
               <td>scheduler</td>
               <td>20</td>
            </tr>
            <tr>
               <td>splunk_archiver-too_small</td>
               <td>16</td>
            </tr>
            <tr>
               <td>splunk_web_access</td>
               <td>35</td>
            </tr>
            <tr>
               <td>splunk_web_service</td>
               <td>236</td>
            </tr>
            <tr>
               <td>splunkd</td>
               <td>266434</td>
            </tr>
            <tr>
               <td>splunkd_access</td>
               <td>778</td>
            </tr>
            <tr>
               <td>splunkd_conf</td>
               <td>1</td>
            </tr>
            <tr>
               <td>splunkd_stderr</td>
               <td>1</td>
            </tr>
            <tr>
               <td>splunkd_ui_access</td>
               <td>833</td>
            </tr>
         </tbody>
      </table>
   </body>
</html>

Re: Code Sample does not work well.

woodcock — Sat, 07 Mar 2020 13:39:34 GMT

Well that stinks.

Re: Code Sample does not work well.

to4kawa — Sat, 07 Mar 2020 20:17:29 GMT

hi @niketnilay
pure <pre></pre> does not contain leading space.
pure <ol><li></li></ol> does not contain leading space, also.
I guess this problem is caused by custom css.

I reported this to support and heard that they would confirm it.
I thank them for their support. I hope to be fixed.