Installation

Escape character is not working in search

leeyounsoo
Path Finder

Hi.

I have a problem with using the 'escape' character in the Search App and Single Value Visualization.

In an older project, I built a dashboard panel that uses the escape character like this :

index=..... (Data Search Query)
| eval C_FIELD = A_FIELD."#".B_FILED 
| fields C_FILED 
| rex mode=sed field=C_FILED "s/#/\n/g" 
| table C_FILED 

That panel used Single Value Visualization, \n character was working as escape character In the Splunk Enterprise 6.2.5 version.

In doing testing that Splunk Enterprise 7.2.x version upgrade job.
but, that Visualization was not showing line break, i found that \n is not read as Escape Character.
that read blank not Escape Character.

6.2.5 version result and Single Value's result :

10:00:00 ~ 11:00:00 
product' informations or comment

7.2.x version :

10:00:00 ~ 11:00:00 product' informations or comment

I know that Single Value Visualization architecture was changed in Splunk Enterprise 6.2.x to 7.x.x version, and In 7.x.x version Single Value Viz was changed text system to canvas system.
but i want that panel look like As-Is system's panel in Testing period.
so, i searching that solution.

consequently, I want know that how to line change in Single Value Viz :
1) way to use Regular Expression in search
2) way to use Built-in xml option like Element
- i wasn't found option In Splunk XML reference Document
3) way to change used CSS, JS file
4) another ways

if you have tips, way, advice, explanation and methods, etc, please help.

Labels (2)
0 Karma
1 Solution

FrankVl
Ultra Champion

Same thing was discussed here: https://answers.splunk.com/answers/750368/how-to-do-a-line-breaking-after-a-string.html

Conclusion was that linebreaks are not supported in single value viz (anymore).

Taking another look using the code inspector of my browser it does seem the linebreak is preserved in the text in the html that is served to the browser, but somehow it doesn't actually cause the line to break at that point. I thought perhaps changing the css white-space property from nowrap to pre (or one of the other settings) might help, but in my quick example at least it did not make much difference. But perhaps this gives you some direction to look at yourself.

View solution in original post

FrankVl
Ultra Champion

Same thing was discussed here: https://answers.splunk.com/answers/750368/how-to-do-a-line-breaking-after-a-string.html

Conclusion was that linebreaks are not supported in single value viz (anymore).

Taking another look using the code inspector of my browser it does seem the linebreak is preserved in the text in the html that is served to the browser, but somehow it doesn't actually cause the line to break at that point. I thought perhaps changing the css white-space property from nowrap to pre (or one of the other settings) might help, but in my quick example at least it did not make much difference. But perhaps this gives you some direction to look at yourself.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...