How to replace line breaks with delimiters?

[paulalbert11]

I'm trying to replicate other threads that show how to replace line breaks with delimiters. This search is not working.

| ldapsearch domain=ED search="(&(objectClass=eduPerson)(weillCornellEduCWID=paa2013))" attrs="weillCornellEduCWID,o" 
| eval o1 = replace (o, "[\\n\\r]+","|")
| eval o2 = replace (o, "[\n\r]","|")
| table weillCornellEduCWID, o, o1, o2

Any ideas? See screenshot below..

[vasanthmss · Accepted solution]

try something like this,

your base search.... | eval o1=o  |nomv o1 | rex mode=sed field=o1 "s/\n/|/g" 

[plimpach]

does exactly what I needed, and much simpler
than the replace function I was trying to get to work.

[paulalbert11]

It works like a charm. Thanks!

[somesoni2]

Does this work?

| ldapsearch domain=ED search="(&(objectClass=eduPerson)(weillCornellEduCWID=paa2013))" attrs="weillCornellEduCWID,o" 
 | eval o1 = replace (o, "[\r\n]+","|")
 | eval o2 = replace (o, "\n","|")
 | table weillCornellEduCWID, o, o1, o2

[paulalbert11]

Thanks for your response, somesoni2. Unfortunately, no. When I run the query, I just get blanks in the o1 and o2 fields.

[somesoni2]

So, if I'm not wrong, the field o is a multivalued field and you just want to make it linear with delimiter as pipe. Is that correct?
If that is correct, what do you get when you run this?

| ldapsearch domain=ED search="(&(objectClass=eduPerson)(weillCornellEduCWID=paa2013))" attrs="weillCornellEduCWID,o" 
  | eval o1 =o | nomv o1

Also, give this a try

| ldapsearch domain=ED search="(&(objectClass=eduPerson)(weillCornellEduCWID=paa2013))" attrs="weillCornellEduCWID,o" 
| eventstats values(o) as o1 delim="|" | nomv o1