topic Re: how to convert a field value of single line to displayed as multilines? in Splunk Search

How to convert a field value of single line to displayed as multilines?

pavanae — Mon, 11 Apr 2022 15:40:33 GMT

Hi Splunkers,

I have defined a filed as follows using eval condition

| eval body = "Sample Example :-" . " ---- " . " HOST INFORMATION: " . " ---- Source Network Address: " . src . " ---- Source Network Hostname: " . srcdns_hostname . " ---- " . " END "

which produces the result as follows

Now, I would like to change the above result into the below format how can I achieve that

Sample Example :- HOST INFORMATION: Source Network Address: 1.1.3.5 Source Network Hostname: ABCD.net END

Re: how to convert a field value of single line to displayed as multilines?

richgalloway — Mon, 11 Apr 2022 00:07:35 GMT

Insert newlines in your eval using CTRL-Enter.

| eval body = "Sample Example :- HOST INFORMATION: Source Network Address: " . src . " Source Network Hostname: " . srcdns_hostname . " END "

Re: how to convert a field value of single line to displayed as multilines?

bowesmana — Mon, 11 Apr 2022 01:21:12 GMT

An alternative to embedding newlines into the eval, you can do it with mvappend, e.g.

| eval body = mvappend("Sample Example :-","HOST INFORMATION: ", "Source Network Address: ".src, "Source Network Hostname: ". srcdns_hostname, "END ")

Note that this results in a different field compared to @richgalloway solution - that form will give you a single value field with embedded newlines, whereas mvappend gives you a multi-value field with each line a separate value of the field.