topic Re: add multiple spaces for fields in Splunk Search

add multiple spaces for fields

sfatnass — Mon, 18 Jul 2016 11:37:00 GMT

hi i want to add multiple space for a fields
i tried to use :
| eval fieldname1= fieldname2 . " " . fieldname3

but splunk show only one space and not more

how can i do to specify more spaces
thx

Re: add multiple spaces for fields

gcusello — Mon, 18 Jul 2016 11:39:04 GMT

try
| eval fieldname1= fieldname2+" "+fieldname3
Bye.
Giuseppe

Re: add multiple spaces for fields

sfatnass — Mon, 18 Jul 2016 11:41:00 GMT

same way splunk show only one space not more
my objectif :
if x is a space.
| eval fieldname1= fieldname2 . "xxxxxxxx" . fieldname3

Re: add multiple spaces for fields

MaryvonneMB — Mon, 18 Jul 2016 12:42:20 GMT

Maybe use underscores instead of spaces? I'm surprising that you want to use multiple spaces.

Re: add multiple spaces for fields

TStrauch — Mon, 18 Jul 2016 12:42:29 GMT

Hi,

the multiple spaces are written to the source code. But html is wrapping multiple whitespaces as one. Its not a problem of splunk its simple html crap.

Means. You have your Spaces in the data. But its not correctly displayed in Browser.

Hope this helps.

Kind regards

Re: add multiple spaces for fields

sfatnass — Mon, 18 Jul 2016 12:45:48 GMT

TStrauch i think you don't understand my aim.
my objectif :
if x is a space.
| eval fieldname1= fieldname2 . "xxxxxxxx" . fieldname3

Re: add multiple spaces for fields

TStrauch — Mon, 18 Jul 2016 12:55:05 GMT

I understand your aim. And its like i explained to you.

Ok lets try this. Take you | eval fieldname1= fieldname2 . "xxxxxxxx" . fieldname3
Start your search.
klick on the interesting fields and klick on fieldname1
take one of the top 10 values and drill down on it.
Your search string will show the spaces.

Your spaces are in your data. They are simply not displayed correctly.

You have a html problem. there are ways like css options "white-space: pre;" or something to display the white spaces.

Re: add multiple spaces for fields

TStrauch — Mon, 18 Jul 2016 12:58:19 GMT

http://www.w3schools.com/cssref/pr_text_white-space.asp

Re: add multiple spaces for fields

sfatnass — Mon, 18 Jul 2016 14:04:12 GMT

ok but what is the balise can i call on my css to specify for my dashboard
white-space:pre;

i see what do you mean, but have you a solution to resolve within dashboard ?

Re: add multiple spaces for fields

woodcock — Mon, 18 Jul 2016 14:05:04 GMT

The same thing happens with newlines inside of the fields (values), too! This frustrates me.

Re: add multiple spaces for fields

sfatnass — Mon, 18 Jul 2016 17:57:47 GMT

i only follow the orders

Re: add multiple spaces for fields

jotne — Thu, 09 Dec 2021 13:17:38 GMT

Old question, but needs a better answer 🙂

You can use a non-breaking-space alt 255

Here you have 10 of them between START-END

START END

So if you like nice space between one field combined from two. add enough blank at end and then cut all equally long.

| eval eventid=eventid." "
| eval eventid=substr(eventid,1,29)
| eval message1=eventid.message