https://community.splunk.com/t5/Splunk-Search/How-to-add-line-break-in-the-eval-function/m-p/212132#M62065 <P>Have you tried</P> <PRE><CODE>base search|eval new = src_host+","+"Event Code="+EventCode+","+"Sub-Code="+code+","+"Reason="+Reason+",\n,"|makemv new delim="," </CODE></PRE> Fri, 04 Nov 2016 17:51:16 GMT richgalloway 2016-11-04T17:51:16Z https://community.splunk.com/t5/Splunk-Search/How-to-add-line-break-in-the-eval-function/m-p/212131#M62064 <P>Hi</P> <P>How to add the line break in the eval function </P> <PRE><CODE>base search|eval new = src_host+","+"Event Code="+EventCode+","+"Sub-Code="+code+","+"Reason="+Reason+","|makemv new delim="," </CODE></PRE> <P>Output:</P> <PRE><CODE>Server1 Event Code=4625 Sub-Code=0xC0000234 Reason=Account locked out. server2 Event Code=4771 Sub-Code=0x12 Reason=NULL </CODE></PRE> <P>What I need:</P> <PRE><CODE>Server1 Event Code=4625 Sub-Code=0xC0000234 Reason=Account locked out. server2 Event Code=4771 Sub-Code=0x12 Reason=NULL </CODE></PRE> Fri, 04 Nov 2016 15:53:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-add-line-break-in-the-eval-function/m-p/212131#M62064 kiran331 2016-11-04T15:53:05Z https://community.splunk.com/t5/Splunk-Search/How-to-add-line-break-in-the-eval-function/m-p/212132#M62065 <P>Have you tried</P> <PRE><CODE>base search|eval new = src_host+","+"Event Code="+EventCode+","+"Sub-Code="+code+","+"Reason="+Reason+",\n,"|makemv new delim="," </CODE></PRE> Fri, 04 Nov 2016 17:51:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-add-line-break-in-the-eval-function/m-p/212132#M62065 richgalloway 2016-11-04T17:51:16Z https://community.splunk.com/t5/Splunk-Search/How-to-add-line-break-in-the-eval-function/m-p/212133#M62066 <P>I tried this, this is the result I got instead of empty line.</P> <P>Server1<BR /> Event Code=4625<BR /> Sub-Code=0xC0000234<BR /> Reason=Account locked out.<BR /> \n<BR /> server2<BR /> Event Code=4771<BR /> Sub-Code=0x12<BR /> Reason=NULL<BR /> \n<BR /> server3<BR /> Event Code=4771<BR /> Sub-Code=0x18<BR /> Reason=NULL<BR /> \n</P> Fri, 04 Nov 2016 18:00:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-add-line-break-in-the-eval-function/m-p/212133#M62066 kiran331 2016-11-04T18:00:04Z https://community.splunk.com/t5/Splunk-Search/How-to-add-line-break-in-the-eval-function/m-p/212134#M62067 <P>Based on those results, I suggest this. Note the two commas following the Reason field.</P> <PRE><CODE>base search|eval new = src_host+","+"Event Code="+EventCode+","+"Sub-Code="+code+","+"Reason="+Reason+",,"|makemv new delim="," </CODE></PRE> Fri, 04 Nov 2016 20:26:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-add-line-break-in-the-eval-function/m-p/212134#M62067 richgalloway 2016-11-04T20:26:16Z