How can I use abstract command

Splunk Search

How can I use abstract command?

My query is

| makeresults

| eval test = " 123456789

123

456"

| abstract maxlines=1

This query shoud be

"test = 123456789" I think..

But whole charecter is shown

Am I wrong understand?..

Get Updates on the Splunk Community!

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...

Join the Conversation