- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Code Sample does not work well.
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Code Sample does not work well.
| makeresults
| eval _raw="Source1_field2,Count
dev,6
prod,5
uat,7
qa,8"
| multikv forceheader=1
| table Source1_field2,Count
| rename COMMENT as "this is sample your stats output"
| transpose 0 header_field=Source1_field2
| eval "prod + uat"=prod+uat
| fields - prod uat
| transpose 0 column_name="Source1_field2" header_field=column
this code works. but code sample add extra space.
copy and paste to search , this is not works.
What should I do?
Source1_field2 Count
dev 6
qa 8
prod + uat 12
This is correct result.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@to4kawa @woodcock this is not a behavior of Splunk, this is a behavior or html table so I dont think issue fix would be there in Splunk.
Refer to this bare-minimal pure html table which still adds whitespace after each cell values. Save as <yourHTMLFileName>.html and open in any browser. When you perform select all you will notice extra space against each values.
<html>
<body>
<table>
<thead>
<tr>
<th><a href="#">sourcetype</a></th>
<th><a href="#">count</a></th>
</tr>
</thead>
<tbody>
<tr>
<td>mongod</td>
<td>130</td>
</tr>
<tr>
<td>scheduler</td>
<td>20</td>
</tr>
<tr>
<td>splunk_archiver-too_small</td>
<td>16</td>
</tr>
<tr>
<td>splunk_web_access</td>
<td>35</td>
</tr>
<tr>
<td>splunk_web_service</td>
<td>236</td>
</tr>
<tr>
<td>splunkd</td>
<td>266434</td>
</tr>
<tr>
<td>splunkd_access</td>
<td>778</td>
</tr>
<tr>
<td>splunkd_conf</td>
<td>1</td>
</tr>
<tr>
<td>splunkd_stderr</td>
<td>1</td>
</tr>
<tr>
<td>splunkd_ui_access</td>
<td>833</td>
</tr>
</tbody>
</table>
</body>
</html>
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi @niketnilay
pure <pre></pre> does not contain leading space.
pure <ol><li></li></ol> does not contain leading space, also.
I guess this problem is caused by custom css.
I reported this to support and heard that they would confirm it.
I thank them for their support. I hope to be fixed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well that stinks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
workaround:
- not use code sample
- use
rex mode=sedbeforemultikvand trim leading spaces. e.g.| rex mode=sed "s/(?m)^\s//g"
Till the issue is fixed, I recommend No.2 solution.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sample:(use <pre></pre> )
| makeresults | eval _raw="Source1_field2,Count dev,6 prod,5 uat,7 qa,8" | multikv forceheader=1 | table Source1_field2,Count | rename COMMENT as "this is sample your stats output" | transpose 0 header_field=Source1_field2 | eval "prod + uat"=prod+uat | fields - prod uat | transpose 0 column_name="Source1_field2" header_field=column
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Same thing. It forces a leading space between the line number and the code so that when selected/cut/pasted, it doesn't work right. And no, CTRL-whatever does not fix it because the reformatting ignores spaces inside if double-quotes (as it should).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sample:( <pre></pre> in comment )
| makeresults
| eval _raw="Source1_field2,Count
dev,6
prod,5
uat,7
qa,8"
| multikv forceheader=1
| table Source1_field2,Count
| rename COMMENT as "this is sample your stats output"
| transpose 0 header_field=Source1_field2
| eval "prod + uat"=prod+uat
| fields - prod uat
| transpose 0 column_name="Source1_field2" header_field=column
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I agree that this is annoying. I wish that there was a a way to either:
Display code sample in such a way that when copying from browser, the leading spaces are not there OR
Have a copy code sample button/option in answers so that it removes the spaces required to for markdown to do code sample.
You should create such a request here:
https://ideas.splunk.com
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanks @woodcock
I asked in Splunk>docs.
This question is created to explain to Splunk.
At present, the CSS of tag <pre></pre> and Code Sample is list notation.
so, extra space is added, I think.
Splunk Ideas
In the Splunk Ideas portal, you can search for, vote on, and request new enhancements (called an idea) for any of the Splunk solutions. Splunk Ideas replaces the need to log a P4 enhancement request ticket with Splunk Support.
I don't think this question is new enhancements . This is just the issue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That does the same (wrong) thing.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@to4kawa Code sample is a readability feature here and in other places. Anytime I copy code from anywhere, I paste it into Splunk, then press control+shift+f, which is a Splunk shortcut for pretty formatting. This addresses readability and to your issue, removes the extra spaces. It allows me to read through the code before I submit it to my Splunk. I think this practice will address your issue.
If this reply helps you, an upvote would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
HI, @efavreau
my question is updated.
If your results is correct, please tell me your browser.
I use ⌘+⇧ +F ,too.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm not able to get your code to result in your answer through manipulating format. When you say it works that way, I have no way of continuing to help.
If this reply helps you, an upvote would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I copied and pasted your sample, which has a leading space on every line, and it works in my Splunk. I did notice that the first line says | makeresults (with a leading space) but when I hit the search button, Splunk auto-removed just that line's leading space, left the others with a leading space, and ran fine.
My browser is Vivaldi 2.10.1745.27 (Stable channel) (64-bit) and Splunk Enterprise is 7.2.8.
Output:
Source1_field2 Count
dev 6
prod 5
uat 7
qa 8
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanks for reply @jpolvino
my question is updated.
please confirm.
Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector
Explore the Latest Educational Offerings from Splunk [January 2025 Updates]
Developer Spotlight with Paul Stout
