How to add line break in the eval function?

[kiran331]

Hi

How to add the line break in the eval function

base search|eval new =  src_host+","+"Event Code="+EventCode+","+"Sub-Code="+code+","+"Reason="+Reason+","|makemv new delim=","

Output:

Server1
Event Code=4625
Sub-Code=0xC0000234
Reason=Account locked out.
server2
Event Code=4771
Sub-Code=0x12
Reason=NULL

What I need:

Server1
Event Code=4625
Sub-Code=0xC0000234
Reason=Account locked out.

server2
Event Code=4771
Sub-Code=0x12
Reason=NULL

[richgalloway]

Have you tried

base search|eval new = src_host+","+"Event Code="+EventCode+","+"Sub-Code="+code+","+"Reason="+Reason+",\n,"|makemv new delim=","

[kiran331]

I tried this, this is the result I got instead of empty line.

Server1
Event Code=4625
Sub-Code=0xC0000234
Reason=Account locked out.
\n
server2
Event Code=4771
Sub-Code=0x12
Reason=NULL
\n
server3
Event Code=4771
Sub-Code=0x18
Reason=NULL
\n

[richgalloway]

Based on those results, I suggest this. Note the two commas following the Reason field.

base search|eval new = src_host+","+"Event Code="+EventCode+","+"Sub-Code="+code+","+"Reason="+Reason+",,"|makemv new delim=","