topic Flatten transaction in Splunk Search

Flatten transaction

msarro — Thu, 29 Sep 2011 16:30:09 GMT

Greetings everyone. This is hopefully a pretty simple question - is there a way to "flatten" transactions? After it runs, you end up with a transaction which is a multiline event. What I'd like to do is flatten the lines into a single line of text. For items where there are multiple matching lines, compress them into a single line which is semicolon delimited or something. Any ideas?

Re: Flatten transaction

Ayn — Thu, 29 Sep 2011 16:42:19 GMT

You could replace newline characters using rex:

<yoursearch> | rex field=_raw mode=sed "s/[\r\n]//g"

The default output in the search app will still wrap lines though, so if you want everything unwrapped on one single line one option would be to use table.

<yoursearch> | eval eventtext=_raw | table _time eventtext

(using _raw directly in table does not work).