hello
I need to do a line breaking after "%" and after " on a total of "
| eval Perc=round((NbTOUCHNGOCrashByHost/NbIndHost)*100,1). " %" + " on a total of " + NbIndHost + " machines "
could tyou help me please?
Hi @jip31,
You can use rex command as sed mode to add new line character at two points of your string.
try this:
| makeresults count=1
| eval Perc=round((NbTOUCHNGOCrashByHost/NbIndHost)*100,1). " %" + " on a total of " + NbIndHost + " machines "
| rex mode=sed field=Perc "s/%/%\n/g"
| rex mode=sed field=Perc "s/on a total of/on a total of\n/g"
Hi @jip31,
You can use rex command as sed mode to add new line character at two points of your string.
try this:
| makeresults count=1
| eval Perc=round((NbTOUCHNGOCrashByHost/NbIndHost)*100,1). " %" + " on a total of " + NbIndHost + " machines "
| rex mode=sed field=Perc "s/%/%\n/g"
| rex mode=sed field=Perc "s/on a total of/on a total of\n/g"
Hi
I have changed the sentance:
| eval Perc=round((NbTOUCHNGOCrashByHost/NbIndHost)*100,1). " %" + " / " + NbIndHost + " machines "
but it doesnt works
| eval Perc=round((NbMESCrashByHost/NbIndHost)*100,1). " %" + " / " + NbIndHost + " machines "
| rex mode=sed field=Perc "s/%/%\n/g"
| table Perc
an idea please???
Can you tell me what Splunk version you are using? Also, are you displaying this on the dashboard?
To my mind the rex command is not correct
you might want to escape the \\
in the sed regex:
| rex mode=sed field=Perc "s/%/%\\n/g"
| rex mode=sed field=Perc "s/on a total of/on a total of\\n/g"
cheers, MuS
it actually works both ways, with or without escaping:
| makeresults
| eval foo=" need to do a line breaking after % and after \" on a total of \" "
| rex mode=sed field=foo "s/%/&\n/g"
| rex mode=sed field=foo "s/on a total of /&\\n/g"
cheers, MuS
like i said earlier I have changed the sentance
now I use it :
| eval Perc=round((NbMESCrashByHost/NbIndHost)*100,1). " %" + " / " + NbIndHost + " machines "
but when I m doing | rex mode=sed field=Perc "s/%/%\n/g" there is always no breakdown...
Works fine for me (using exactly the code you posted here): https://imgur.com/VV4Hd2A
Please share a screenshot of your situation.
done
I need / 40 machines under the percentage
I join also the xml piece :
| table host] index="x" sourcetype="PerfmonMk:Process" process_name=chrome ("%_Processor_Time"=0)
| dedup host
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE
| stats count as NbMESCrashByHost by host SITE
| search SITE=$tok_filtersite$
| appendcols
[| inputlookup host.csv
| stats count as NbIndHost]
| eval Perc=round((NbMESCrashByHost/NbIndHost)*100,1). " %" + " / " + NbIndHost + " machines "
| rex mode=sed field=Perc "s/%/%\n/g"
| table Perc
Right, so the issue is in displaying it as a single value. Apparently that viz does not support multiple lines. I indeed get the same result. I'm afraid what you want is not possible then. (or at least not with pure simple xml dashboard functionality).
Grrrrrrrrrrrrrr
ok fraanck thanks although
Can you tell what value you are getting for Per
at the end of eval.
7.0.1 version
When you say line breaking, do you mean in context of event breaking in props.conf?
Not at all