Splunk Search

How to convert a field value of single line to displayed as multilines?

pavanae
Builder

Hi Splunkers, 

I have defined a filed as follows using eval condition 

 

 

 

| eval body = "Sample Example :-" . 
" ---- " . " HOST INFORMATION: " . 
" ---- Source Network Address: " . src . 
" ---- Source Network Hostname: " . srcdns_hostname . 
" ---- " . " END "

 

 

 

which produces the result as follows 

sample.PNG

Now, I would like to change the above result into the below format how can I achieve that 

 

 

 

Sample Example :- 
HOST INFORMATION: 
Source Network Address: 1.1.3.5 
Source Network Hostname: ABCD.net
END 

 

 

 

 

Labels (5)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

An alternative to embedding newlines into the eval, you can do it with mvappend, e.g.

| eval body = mvappend("Sample Example :-","HOST INFORMATION: ", "Source Network Address: ".src, "Source Network Hostname: ". srcdns_hostname, "END ")

Note that this results in a different field compared to @richgalloway solution - that form will give you a single value field with embedded newlines, whereas mvappend gives you a multi-value field with each line a separate value of the field.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

An alternative to embedding newlines into the eval, you can do it with mvappend, e.g.

| eval body = mvappend("Sample Example :-","HOST INFORMATION: ", "Source Network Address: ".src, "Source Network Hostname: ". srcdns_hostname, "END ")

Note that this results in a different field compared to @richgalloway solution - that form will give you a single value field with embedded newlines, whereas mvappend gives you a multi-value field with each line a separate value of the field.

 

richgalloway
SplunkTrust
SplunkTrust

 Insert newlines in your eval using CTRL-Enter.

| eval body = "Sample Example :- 
HOST INFORMATION: 
Source Network Address: " . src . "
Source Network Hostname: " . srcdns_hostname . " 
END "

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...