Splunk Search

How to add spaces in between my big splunk query?

pavanae
Builder

I always wonder how can I break my big splunk query on the dashboard to multiple parts like by providing spaces in between the lines.

For example if below is my query

index=blah source=abc | eval abc="jkhdkkjd" | search NOT field="bvc"

Now how can I break the above into below by providing a line gap between the next part of the query

index=blah source=abc | eval abc="jkhdkkjd"

| search NOT field="bvc"

Note :-

I just wanna add spaces/line gaps between my query and not on the results.

0 Karma
1 Solution

aholzer
Motivator

If you are running version 6.6+, you can use the hotkey "ctrl + |" (control + pipe) and it should automatically break each pipe out into it's own line, and it will indent subsearches automatically as well.

If you don't like the way it does it or you are running an older version, you can hit "shift + enter" and this does the equivalent of adding a new line character, instead of running your search.

Hope this helps

View solution in original post

0 Karma

aholzer
Motivator

If you are running version 6.6+, you can use the hotkey "ctrl + |" (control + pipe) and it should automatically break each pipe out into it's own line, and it will indent subsearches automatically as well.

If you don't like the way it does it or you are running an older version, you can hit "shift + enter" and this does the equivalent of adding a new line character, instead of running your search.

Hope this helps

0 Karma

kmaron
Motivator

You can have linebreaks in your search query in your source.

Mine look like this:

  <query>search source="ACTRL*"  
 | eval mytimes=mvappend(_time,relative_time(_time,"-15m"),relative_time(_time,"+15m"))
 | mvexpand mytimes
 | search mytimes &lt; now()
 | eval _time=mytimes
 | timechart  avg(_QUEUE_DEPTH) span=15m</query>
0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...