Installation

Escape character is not working in search

leeyounsoo
Path Finder

Hi.

I have a problem with using the 'escape' character in the Search App and Single Value Visualization.

In an older project, I built a dashboard panel that uses the escape character like this :

index=..... (Data Search Query)
| eval C_FIELD = A_FIELD."#".B_FILED 
| fields C_FILED 
| rex mode=sed field=C_FILED "s/#/\n/g" 
| table C_FILED 

That panel used Single Value Visualization, \n character was working as escape character In the Splunk Enterprise 6.2.5 version.

In doing testing that Splunk Enterprise 7.2.x version upgrade job.
but, that Visualization was not showing line break, i found that \n is not read as Escape Character.
that read blank not Escape Character.

6.2.5 version result and Single Value's result :

10:00:00 ~ 11:00:00 
product' informations or comment

7.2.x version :

10:00:00 ~ 11:00:00 product' informations or comment

I know that Single Value Visualization architecture was changed in Splunk Enterprise 6.2.x to 7.x.x version, and In 7.x.x version Single Value Viz was changed text system to canvas system.
but i want that panel look like As-Is system's panel in Testing period.
so, i searching that solution.

consequently, I want know that how to line change in Single Value Viz :
1) way to use Regular Expression in search
2) way to use Built-in xml option like Element
- i wasn't found option In Splunk XML reference Document
3) way to change used CSS, JS file
4) another ways

if you have tips, way, advice, explanation and methods, etc, please help.

Labels (2)
0 Karma
1 Solution

FrankVl
Ultra Champion

Same thing was discussed here: https://answers.splunk.com/answers/750368/how-to-do-a-line-breaking-after-a-string.html

Conclusion was that linebreaks are not supported in single value viz (anymore).

Taking another look using the code inspector of my browser it does seem the linebreak is preserved in the text in the html that is served to the browser, but somehow it doesn't actually cause the line to break at that point. I thought perhaps changing the css white-space property from nowrap to pre (or one of the other settings) might help, but in my quick example at least it did not make much difference. But perhaps this gives you some direction to look at yourself.

View solution in original post

FrankVl
Ultra Champion

Same thing was discussed here: https://answers.splunk.com/answers/750368/how-to-do-a-line-breaking-after-a-string.html

Conclusion was that linebreaks are not supported in single value viz (anymore).

Taking another look using the code inspector of my browser it does seem the linebreak is preserved in the text in the html that is served to the browser, but somehow it doesn't actually cause the line to break at that point. I thought perhaps changing the css white-space property from nowrap to pre (or one of the other settings) might help, but in my quick example at least it did not make much difference. But perhaps this gives you some direction to look at yourself.

Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...