https://community.splunk.com/t5/Splunk-Search/How-to-insert-empty-lines-in-the-field-before-and-after-a/m-p/491363#M194221 <P>Try <CODE>"s/(\*+ MEMORY \*+)/\nn\1\n/"</CODE>.</P> Tue, 19 Nov 2019 21:17:49 GMT richgalloway 2019-11-19T21:17:49Z https://community.splunk.com/t5/Splunk-Search/How-to-insert-empty-lines-in-the-field-before-and-after-a/m-p/491359#M194217 <P>Hello,</P> <P>I have a column / field called LINE that consists of the several text lines.<BR /> I would like to format it a bit before I present it to the end users in the alert using $result.LINE$.<BR /> I have there the following header line:</P> <PRE><CODE>**************************** </CODE></PRE> <P>and I would like to insert two empty lines before and one empty line below of it into the LINE field.</P> <P>How would I do it?</P> <P>Kind Regards,<BR /> Kamil</P> Tue, 19 Nov 2019 15:58:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-insert-empty-lines-in-the-field-before-and-after-a/m-p/491359#M194217 damucka 2019-11-19T15:58:15Z https://community.splunk.com/t5/Splunk-Search/How-to-insert-empty-lines-in-the-field-before-and-after-a/m-p/491360#M194218 <P>Try <CODE>rex</CODE>.</P> <PRE><CODE>... | rex field=LINE mode=sed "s/(\*{28})/\n\n\1\n/" </CODE></PRE> Tue, 19 Nov 2019 16:25:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-insert-empty-lines-in-the-field-before-and-after-a/m-p/491360#M194218 richgalloway 2019-11-19T16:25:49Z https://community.splunk.com/t5/Splunk-Search/How-to-insert-empty-lines-in-the-field-before-and-after-a/m-p/491361#M194219 <P>Thank you.<BR /> This would do what I want. One more question, how would the sed for the following header line look like?<BR /> ... I am struggling with it a bit in regex101</P> <PRE><CODE>******************************* MEMORY ************************************* </CODE></PRE> Tue, 19 Nov 2019 19:21:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-insert-empty-lines-in-the-field-before-and-after-a/m-p/491361#M194219 damucka 2019-11-19T19:21:23Z https://community.splunk.com/t5/Splunk-Search/How-to-insert-empty-lines-in-the-field-before-and-after-a/m-p/491362#M194220 <P>It would be best if you let each question stand alone, as well as state what you tried. However, try this:<BR /> <A href="https://regex101.com/r/xPYiLc/1">https://regex101.com/r/xPYiLc/1</A></P> Tue, 19 Nov 2019 21:16:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-insert-empty-lines-in-the-field-before-and-after-a/m-p/491362#M194220 efavreau 2019-11-19T21:16:39Z https://community.splunk.com/t5/Splunk-Search/How-to-insert-empty-lines-in-the-field-before-and-after-a/m-p/491363#M194221 <P>Try <CODE>"s/(\*+ MEMORY \*+)/\nn\1\n/"</CODE>.</P> Tue, 19 Nov 2019 21:17:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-insert-empty-lines-in-the-field-before-and-after-a/m-p/491363#M194221 richgalloway 2019-11-19T21:17:49Z https://community.splunk.com/t5/Splunk-Search/How-to-insert-empty-lines-in-the-field-before-and-after-a/m-p/491364#M194222 <P>Also, @damucka make sure you accept the answer.</P> Tue, 19 Nov 2019 21:19:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-insert-empty-lines-in-the-field-before-and-after-a/m-p/491364#M194222 efavreau 2019-11-19T21:19:17Z