How can I use abstract command

Splunk Search

How can I use abstract command?

My query is

| makeresults

| eval test = " 123456789

123

456"

| abstract maxlines=1

This query shoud be

"test = 123456789" I think..

But whole charecter is shown

Am I wrong understand?..

Get Updates on the Splunk Community!

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...