Splunk Search

How can I use abstract command

tkdguq0110
Path Finder

How can I use abstract command?

My query is

| makeresults

| eval test = " 123456789

123

456"

| abstract maxlines=1

 This query shoud be 

"test = 123456789" I think..

But whole charecter is shown

Am I wrong understand?..

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...