topic Re: Syntax to break a line in search so that it breaks into two lines in servicenow in Splunk Search

Syntax to break a line in search so that it breaks into two lines in servicenow

man03359 — Tue, 06 Feb 2024 14:19:57 GMT

Hi All,

I have a field called summary in my search -

Failed backup of the transaction log for SQL Server database 'model' from 'WSQL040Q.tkmaxx.tjxcorp.net\\MSSQLSERVER'.

I am creating this search for service-now alert and I am sending this summary field value under comments in ServiceNow.

I need it to break in two lines like this -

Line1-Failed backup of the transaction log for SQL Server database 'model' from
Line2-'WSQL040Q.tkmaxx.tjxcorp.net\\MSSQLSERVER'.

How do I implement this in my Search?

Thanks In Advance!

Re: Syntax to break a line in search so that it breaks into two lines in servicenow

richgalloway — Tue, 06 Feb 2024 15:27:14 GMT

If SNOW will interpret a newline character as dividing the field into two lines then this may work.

| rex field=summary mode=sed "s/from '(.*)/from\n'\1/"

Re: Syntax to break a line in search so that it breaks into two lines in servicenow

yuanliu — Thu, 08 Feb 2024 05:04:40 GMT

Alternatively, if ServiceNow accepts literal newline, you can just insert newline

| eval summary = replace(summary, " from ", " from ")

Re: Syntax to break a line in search so that it breaks into two lines in servicenow

man03359 — Thu, 08 Feb 2024 18:24:32 GMT

@richgalloway It worked, thanks a lot 🙂

Also, could you please explain it to me, or is there any docs I may refer to?

Re: Syntax to break a line in search so that it breaks into two lines in servicenow

richgalloway — Thu, 08 Feb 2024 18:40:18 GMT

The rex command can either extract fields from an event or replace text in an event. In this case, mode=sed tells it to replace text. The field=summary option restricts the command to the contents of the summary field.

The quoted string is the sed command to execute. The 's' represents the substitute command. The part after the first slash is a regular expression. It says to look for the string "from '" followed by any number of additional characters (.*). The parentheses create a group we'll refer back to later. The part after the next slash is the replacement text. It puts the "from" back, adds a newline character (\n), then adds the remainder of the original text (the group from part 1).

To read more about rex, see the Search Reference manual. https://docs.splunk.com/Documentation/Splunk/9.2.0/SearchReference/Rex