Installation

Escape character is not working in search

leeyounsoo
Path Finder

Hi.

I have a problem with using the 'escape' character in the Search App and Single Value Visualization.

In an older project, I built a dashboard panel that uses the escape character like this :

index=..... (Data Search Query)
| eval C_FIELD = A_FIELD."#".B_FILED 
| fields C_FILED 
| rex mode=sed field=C_FILED "s/#/\n/g" 
| table C_FILED 

That panel used Single Value Visualization, \n character was working as escape character In the Splunk Enterprise 6.2.5 version.

In doing testing that Splunk Enterprise 7.2.x version upgrade job.
but, that Visualization was not showing line break, i found that \n is not read as Escape Character.
that read blank not Escape Character.

6.2.5 version result and Single Value's result :

10:00:00 ~ 11:00:00 
product' informations or comment

7.2.x version :

10:00:00 ~ 11:00:00 product' informations or comment

I know that Single Value Visualization architecture was changed in Splunk Enterprise 6.2.x to 7.x.x version, and In 7.x.x version Single Value Viz was changed text system to canvas system.
but i want that panel look like As-Is system's panel in Testing period.
so, i searching that solution.

consequently, I want know that how to line change in Single Value Viz :
1) way to use Regular Expression in search
2) way to use Built-in xml option like Element
- i wasn't found option In Splunk XML reference Document
3) way to change used CSS, JS file
4) another ways

if you have tips, way, advice, explanation and methods, etc, please help.

Labels (2)
0 Karma
1 Solution

FrankVl
Ultra Champion

Same thing was discussed here: https://answers.splunk.com/answers/750368/how-to-do-a-line-breaking-after-a-string.html

Conclusion was that linebreaks are not supported in single value viz (anymore).

Taking another look using the code inspector of my browser it does seem the linebreak is preserved in the text in the html that is served to the browser, but somehow it doesn't actually cause the line to break at that point. I thought perhaps changing the css white-space property from nowrap to pre (or one of the other settings) might help, but in my quick example at least it did not make much difference. But perhaps this gives you some direction to look at yourself.

View solution in original post

FrankVl
Ultra Champion

Same thing was discussed here: https://answers.splunk.com/answers/750368/how-to-do-a-line-breaking-after-a-string.html

Conclusion was that linebreaks are not supported in single value viz (anymore).

Taking another look using the code inspector of my browser it does seem the linebreak is preserved in the text in the html that is served to the browser, but somehow it doesn't actually cause the line to break at that point. I thought perhaps changing the css white-space property from nowrap to pre (or one of the other settings) might help, but in my quick example at least it did not make much difference. But perhaps this gives you some direction to look at yourself.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...