Splunk Enterprise Security

Splunk Enterprise Security: Is there a way manually force a newline in notable event descriptions?


We have multiples lines of text in our detailed Splunk ES notable event descriptions. In order to make the text readable by our operations team, we want to manually force a newline when appropriate.

Below are a few sets of newline options we have tried that do not work.

Any ideas? Also note that I need to be able to change this through the edit correlation search GUI and not manual file end from the console command line.


Splunk Employee
Splunk Employee


See item 5

This question seems pretty popular. I would open a support request provide examples of what you are trying to do and why.

The more examples / use cases and customer cases we have the more visible / valid the enhancement becomes.

This was a topic today in our internal chat. Let me know the case number if you do.


Still needing this.

0 Karma


Did you ever find a solution to this?

0 Karma


No solution so far.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...