can I have a multiline search box?

[Alan_Bradley]

It'd be cool if I could add some line breaks to my search so that visual inspection of what I was typing was a little easier on the eyes. Can this be done?

[Lowell]

Just as a word of warning. Multi-line searches can cause some problems in some of splunk's internal logs. This is mostly due to props settings for the log files. Normally this shows up as time-stamping errors in the splunkd.log source.

For example, the auditrail, splunkd, and searches (I think) sourcetypes are not setup for multi-line events. And in some places the multi-line searches get logged across lines which causes the timestamping issue. Other times, the searches get wrapped as a single line, and this isn't a problem. (I tracked this down once, I think. But can't remember what the common factor was as to when this seems to happen.)

In my own config, I've added SHOULD_LINEMERGE = True to these sourcetypes to make this problem go away. (I realize this probably isn't as efficient, but it seemed like the best workaround)

[matt · Accepted solution]

You can type shift-enter in the search bar to add a line break. The search bar will open to a max of 4 lines.

[matt]

Good to know. Thanks for the clarification

[Johnvey]

Your search can be as many lines as you want -- the 4 line limit is just how big the textarea will grow.