Splunk Search

Double spaces are suppressed in search results

andygerberkp
Explorer
|makeresults| eval owner_realname="Andrew  Gerber" | where match (owner_realname,"\s{2}")

Search above generates output, but in the output the double space in the "owner_realname" is missing in the browser display (it is present if you download it via CSV).

alt text

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Your browser is choosing not to display the second space - it's there if you inspect the HTML.

View solution in original post

chrisyounger
SplunkTrust
SplunkTrust

Agree with Martin. In addition, in Splunk 7.2 I can actually see two spaces when I run your query: alt text

martin_mueller
SplunkTrust
SplunkTrust

Your browser is choosing not to display the second space - it's there if you inspect the HTML.

andygerberkp
Explorer

Exactly right Martin, thank you.

<td data-cell-index="1" class="string" tabindex="> Andrew  Gerber                       </td>
0 Karma

woodcock
Esteemed Legend

You should click Accept to close this question.

0 Karma

andygerberkp
Explorer

Yessir! Done and done!

Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...