Splunk Search

How to add line break in the eval function?

Builder

Hi

How to add the line break in the eval function

base search|eval new =  src_host+","+"Event Code="+EventCode+","+"Sub-Code="+code+","+"Reason="+Reason+","|makemv new delim=","

Output:

Server1
Event Code=4625
Sub-Code=0xC0000234
Reason=Account locked out.
server2
Event Code=4771
Sub-Code=0x12
Reason=NULL

What I need:

Server1
Event Code=4625
Sub-Code=0xC0000234
Reason=Account locked out.

server2
Event Code=4771
Sub-Code=0x12
Reason=NULL
0 Karma

SplunkTrust
SplunkTrust

Have you tried

base search|eval new = src_host+","+"Event Code="+EventCode+","+"Sub-Code="+code+","+"Reason="+Reason+",\n,"|makemv new delim=","
---
If this reply helps you, an upvote would be appreciated.

Builder

I tried this, this is the result I got instead of empty line.

Server1
Event Code=4625
Sub-Code=0xC0000234
Reason=Account locked out.
\n
server2
Event Code=4771
Sub-Code=0x12
Reason=NULL
\n
server3
Event Code=4771
Sub-Code=0x18
Reason=NULL
\n

0 Karma

SplunkTrust
SplunkTrust

Based on those results, I suggest this. Note the two commas following the Reason field.

base search|eval new = src_host+","+"Event Code="+EventCode+","+"Sub-Code="+code+","+"Reason="+Reason+",,"|makemv new delim=","
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!