How can I use abstract command

Splunk Search

How can I use abstract command?

My query is

| makeresults

| eval test = " 123456789

123

456"

| abstract maxlines=1

This query shoud be

"test = 123456789" I think..

But whole charecter is shown

Am I wrong understand?..

Get Updates on the Splunk Community!

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024 | 11AM PT / 2PM ETREGISTER ...

More for SLO Management We’re continuing to expand the built-in SLO management experience in Splunk ...

In June, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...