Splunk Search

Double spaces are suppressed in search results

andygerberkp
Explorer
|makeresults| eval owner_realname="Andrew  Gerber" | where match (owner_realname,"\s{2}")

Search above generates output, but in the output the double space in the "owner_realname" is missing in the browser display (it is present if you download it via CSV).

alt text

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Your browser is choosing not to display the second space - it's there if you inspect the HTML.

View solution in original post

chrisyounger
SplunkTrust
SplunkTrust

Agree with Martin. In addition, in Splunk 7.2 I can actually see two spaces when I run your query: alt text

martin_mueller
SplunkTrust
SplunkTrust

Your browser is choosing not to display the second space - it's there if you inspect the HTML.

andygerberkp
Explorer

Exactly right Martin, thank you.

<td data-cell-index="1" class="string" tabindex="> Andrew  Gerber                       </td>
0 Karma

woodcock
Esteemed Legend

You should click Accept to close this question.

0 Karma

andygerberkp
Explorer

Yessir! Done and done!

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...