Archive

How to insert empty lines in the field before and after a specific pattern?

Contributor

Hello,

I have a column / field called LINE that consists of the several text lines.
I would like to format it a bit before I present it to the end users in the alert using $result.LINE$.
I have there the following header line:

****************************

and I would like to insert two empty lines before and one empty line below of it into the LINE field.

How would I do it?

Kind Regards,
Kamil

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try rex.

... | rex field=LINE mode=sed "s/(\*{28})/\n\n\1\n/"
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try rex.

... | rex field=LINE mode=sed "s/(\*{28})/\n\n\1\n/"
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Builder

Also, @damucka make sure you accept the answer.

###

If this reply helps you, an upvote would be appreciated.
0 Karma

Contributor

Thank you.
This would do what I want. One more question, how would the sed for the following header line look like?
... I am struggling with it a bit in regex101

******************************* MEMORY *************************************
0 Karma

SplunkTrust
SplunkTrust

Try "s/(\*+ MEMORY \*+)/\nn\1\n/".

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Builder

It would be best if you let each question stand alone, as well as state what you tried. However, try this:
https://regex101.com/r/xPYiLc/1

###

If this reply helps you, an upvote would be appreciated.
0 Karma