Splunk Search

Flatten transaction

msarro
Builder

Greetings everyone. This is hopefully a pretty simple question - is there a way to "flatten" transactions? After it runs, you end up with a transaction which is a multiline event. What I'd like to do is flatten the lines into a single line of text. For items where there are multiple matching lines, compress them into a single line which is semicolon delimited or something. Any ideas?

Tags (1)
0 Karma

Ayn
Legend

You could replace newline characters using rex:

<yoursearch> | rex field=_raw mode=sed "s/[\r\n]//g"

The default output in the search app will still wrap lines though, so if you want everything unwrapped on one single line one option would be to use table.

<yoursearch> | eval eventtext=_raw | table _time eventtext

(using _raw directly in table does not work).

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...