How to add spaces in between my big splunk query?

[pavanae]

I always wonder how can I break my big splunk query on the dashboard to multiple parts like by providing spaces in between the lines.

For example if below is my query

index=blah source=abc | eval abc="jkhdkkjd" | search NOT field="bvc"

Now how can I break the above into below by providing a line gap between the next part of the query

index=blah source=abc | eval abc="jkhdkkjd"

| search NOT field="bvc"

Note :-

I just wanna add spaces/line gaps between my query and not on the results.

[aholzer · Accepted solution]

If you are running version 6.6+, you can use the hotkey "ctrl + |" (control + pipe) and it should automatically break each pipe out into it's own line, and it will indent subsearches automatically as well.

If you don't like the way it does it or you are running an older version, you can hit "shift + enter" and this does the equivalent of adding a new line character, instead of running your search.

Hope this helps

[kmaron]

You can have linebreaks in your search query in your source.

Mine look like this:

  <query>search source="ACTRL*"  
 | eval mytimes=mvappend(_time,relative_time(_time,"-15m"),relative_time(_time,"+15m"))
 | mvexpand mytimes
 | search mytimes &lt; now()
 | eval _time=mytimes
 | timechart  avg(_QUEUE_DEPTH) span=15m</query>