Splunk Search

Double spaces are suppressed in search results

andygerberkp
Explorer
|makeresults| eval owner_realname="Andrew  Gerber" | where match (owner_realname,"\s{2}")

Search above generates output, but in the output the double space in the "owner_realname" is missing in the browser display (it is present if you download it via CSV).

alt text

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Your browser is choosing not to display the second space - it's there if you inspect the HTML.

View solution in original post

chrisyounger
SplunkTrust
SplunkTrust

Agree with Martin. In addition, in Splunk 7.2 I can actually see two spaces when I run your query: alt text

martin_mueller
SplunkTrust
SplunkTrust

Your browser is choosing not to display the second space - it's there if you inspect the HTML.

andygerberkp
Explorer

Exactly right Martin, thank you.

<td data-cell-index="1" class="string" tabindex="> Andrew  Gerber                       </td>
0 Karma

woodcock
Esteemed Legend

You should click Accept to close this question.

0 Karma

andygerberkp
Explorer

Yessir! Done and done!

Get Updates on the Splunk Community!

Simplifying the Analyst Experience with Finding-based Detections

    Splunk invites you to an engaging Tech Talk focused on streamlining security operations with ...

[Puzzles] Solve, Learn, Repeat: Word Search

This challenge was first posted on Slack #puzzles channelThis puzzle is based on a letter grid containing ...

[Puzzles] Solve, Learn, Repeat: Advent of Code - Day 4

Advent of CodeIn order to participate in these challenges, you will need to register with the Advent of Code ...