How can I use abstract command

Splunk Search

How can I use abstract command?

My query is

| makeresults

| eval test = " 123456789

123

456"

| abstract maxlines=1

This query shoud be

"test = 123456789" I think..

But whole charecter is shown

Am I wrong understand?..

Get Updates on the Splunk Community!

We’ve all been there, right? Living our best life, working on our Splunk environment, when out of nowhere a ...

Set Up Data Where You Use It Catalog already helps teams find and understand data across Splunk indexes, ...

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Join the Conversation