Splunk Search

How to add spaces in between my big splunk query?

pavanae
Builder

I always wonder how can I break my big splunk query on the dashboard to multiple parts like by providing spaces in between the lines.

For example if below is my query

index=blah source=abc | eval abc="jkhdkkjd" | search NOT field="bvc"

Now how can I break the above into below by providing a line gap between the next part of the query

index=blah source=abc | eval abc="jkhdkkjd"

| search NOT field="bvc"

Note :-

I just wanna add spaces/line gaps between my query and not on the results.

0 Karma
1 Solution

aholzer
Motivator

If you are running version 6.6+, you can use the hotkey "ctrl + |" (control + pipe) and it should automatically break each pipe out into it's own line, and it will indent subsearches automatically as well.

If you don't like the way it does it or you are running an older version, you can hit "shift + enter" and this does the equivalent of adding a new line character, instead of running your search.

Hope this helps

View solution in original post

0 Karma

aholzer
Motivator

If you are running version 6.6+, you can use the hotkey "ctrl + |" (control + pipe) and it should automatically break each pipe out into it's own line, and it will indent subsearches automatically as well.

If you don't like the way it does it or you are running an older version, you can hit "shift + enter" and this does the equivalent of adding a new line character, instead of running your search.

Hope this helps

0 Karma

kmaron
Motivator

You can have linebreaks in your search query in your source.

Mine look like this:

  <query>search source="ACTRL*"  
 | eval mytimes=mvappend(_time,relative_time(_time,"-15m"),relative_time(_time,"+15m"))
 | mvexpand mytimes
 | search mytimes &lt; now()
 | eval _time=mytimes
 | timechart  avg(_QUEUE_DEPTH) span=15m</query>
0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...