Splunk Search

Double spaces are suppressed in search results

andygerberkp
Explorer
|makeresults| eval owner_realname="Andrew  Gerber" | where match (owner_realname,"\s{2}")

Search above generates output, but in the output the double space in the "owner_realname" is missing in the browser display (it is present if you download it via CSV).

alt text

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Your browser is choosing not to display the second space - it's there if you inspect the HTML.

View solution in original post

chrisyounger
SplunkTrust
SplunkTrust

Agree with Martin. In addition, in Splunk 7.2 I can actually see two spaces when I run your query: alt text

martin_mueller
SplunkTrust
SplunkTrust

Your browser is choosing not to display the second space - it's there if you inspect the HTML.

andygerberkp
Explorer

Exactly right Martin, thank you.

<td data-cell-index="1" class="string" tabindex="> Andrew  Gerber                       </td>
0 Karma

woodcock
Esteemed Legend

You should click Accept to close this question.

0 Karma

andygerberkp
Explorer

Yessir! Done and done!

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...