Splunk Search

How to add spaces in between my big splunk query?

pavanae
Builder

I always wonder how can I break my big splunk query on the dashboard to multiple parts like by providing spaces in between the lines.

For example if below is my query

index=blah source=abc | eval abc="jkhdkkjd" | search NOT field="bvc"

Now how can I break the above into below by providing a line gap between the next part of the query

index=blah source=abc | eval abc="jkhdkkjd"

| search NOT field="bvc"

Note :-

I just wanna add spaces/line gaps between my query and not on the results.

0 Karma
1 Solution

aholzer
Motivator

If you are running version 6.6+, you can use the hotkey "ctrl + |" (control + pipe) and it should automatically break each pipe out into it's own line, and it will indent subsearches automatically as well.

If you don't like the way it does it or you are running an older version, you can hit "shift + enter" and this does the equivalent of adding a new line character, instead of running your search.

Hope this helps

View solution in original post

0 Karma

aholzer
Motivator

If you are running version 6.6+, you can use the hotkey "ctrl + |" (control + pipe) and it should automatically break each pipe out into it's own line, and it will indent subsearches automatically as well.

If you don't like the way it does it or you are running an older version, you can hit "shift + enter" and this does the equivalent of adding a new line character, instead of running your search.

Hope this helps

View solution in original post

0 Karma

kmaron
Motivator

You can have linebreaks in your search query in your source.

Mine look like this:

  <query>search source="ACTRL*"  
 | eval mytimes=mvappend(_time,relative_time(_time,"-15m"),relative_time(_time,"+15m"))
 | mvexpand mytimes
 | search mytimes &lt; now()
 | eval _time=mytimes
 | timechart  avg(_QUEUE_DEPTH) span=15m</query>
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!