Installation

Escape character is not working in search

leeyounsoo
Path Finder

Hi.

I have a problem with using the 'escape' character in the Search App and Single Value Visualization.

In an older project, I built a dashboard panel that uses the escape character like this :

index=..... (Data Search Query)
| eval C_FIELD = A_FIELD."#".B_FILED 
| fields C_FILED 
| rex mode=sed field=C_FILED "s/#/\n/g" 
| table C_FILED 

That panel used Single Value Visualization, \n character was working as escape character In the Splunk Enterprise 6.2.5 version.

In doing testing that Splunk Enterprise 7.2.x version upgrade job.
but, that Visualization was not showing line break, i found that \n is not read as Escape Character.
that read blank not Escape Character.

6.2.5 version result and Single Value's result :

10:00:00 ~ 11:00:00 
product' informations or comment

7.2.x version :

10:00:00 ~ 11:00:00 product' informations or comment

I know that Single Value Visualization architecture was changed in Splunk Enterprise 6.2.x to 7.x.x version, and In 7.x.x version Single Value Viz was changed text system to canvas system.
but i want that panel look like As-Is system's panel in Testing period.
so, i searching that solution.

consequently, I want know that how to line change in Single Value Viz :
1) way to use Regular Expression in search
2) way to use Built-in xml option like Element
- i wasn't found option In Splunk XML reference Document
3) way to change used CSS, JS file
4) another ways

if you have tips, way, advice, explanation and methods, etc, please help.

Labels (1)
0 Karma
1 Solution

FrankVl
Ultra Champion

Same thing was discussed here: https://answers.splunk.com/answers/750368/how-to-do-a-line-breaking-after-a-string.html

Conclusion was that linebreaks are not supported in single value viz (anymore).

Taking another look using the code inspector of my browser it does seem the linebreak is preserved in the text in the html that is served to the browser, but somehow it doesn't actually cause the line to break at that point. I thought perhaps changing the css white-space property from nowrap to pre (or one of the other settings) might help, but in my quick example at least it did not make much difference. But perhaps this gives you some direction to look at yourself.

View solution in original post

FrankVl
Ultra Champion

Same thing was discussed here: https://answers.splunk.com/answers/750368/how-to-do-a-line-breaking-after-a-string.html

Conclusion was that linebreaks are not supported in single value viz (anymore).

Taking another look using the code inspector of my browser it does seem the linebreak is preserved in the text in the html that is served to the browser, but somehow it doesn't actually cause the line to break at that point. I thought perhaps changing the css white-space property from nowrap to pre (or one of the other settings) might help, but in my quick example at least it did not make much difference. But perhaps this gives you some direction to look at yourself.

Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...