How can I use abstract command

Splunk Search

How can I use abstract command?

My query is

| makeresults

| eval test = " 123456789

123

456"

| abstract maxlines=1

This query shoud be

"test = 123456789" I think..

But whole charecter is shown

Am I wrong understand?..

Get Updates on the Splunk Community!

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...

Join the Conversation