Splunk Search

How to convert a field value of single line to displayed as multilines?

pavanae
Builder

Hi Splunkers, 

I have defined a filed as follows using eval condition 

 

 

 

| eval body = "Sample Example :-" . 
" ---- " . " HOST INFORMATION: " . 
" ---- Source Network Address: " . src . 
" ---- Source Network Hostname: " . srcdns_hostname . 
" ---- " . " END "

 

 

 

which produces the result as follows 

sample.PNG

Now, I would like to change the above result into the below format how can I achieve that 

 

 

 

Sample Example :- 
HOST INFORMATION: 
Source Network Address: 1.1.3.5 
Source Network Hostname: ABCD.net
END 

 

 

 

 

Labels (5)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

An alternative to embedding newlines into the eval, you can do it with mvappend, e.g.

| eval body = mvappend("Sample Example :-","HOST INFORMATION: ", "Source Network Address: ".src, "Source Network Hostname: ". srcdns_hostname, "END ")

Note that this results in a different field compared to @richgalloway solution - that form will give you a single value field with embedded newlines, whereas mvappend gives you a multi-value field with each line a separate value of the field.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

An alternative to embedding newlines into the eval, you can do it with mvappend, e.g.

| eval body = mvappend("Sample Example :-","HOST INFORMATION: ", "Source Network Address: ".src, "Source Network Hostname: ". srcdns_hostname, "END ")

Note that this results in a different field compared to @richgalloway solution - that form will give you a single value field with embedded newlines, whereas mvappend gives you a multi-value field with each line a separate value of the field.

 

richgalloway
SplunkTrust
SplunkTrust

 Insert newlines in your eval using CTRL-Enter.

| eval body = "Sample Example :- 
HOST INFORMATION: 
Source Network Address: " . src . "
Source Network Hostname: " . srcdns_hostname . " 
END "

 

---
If this reply helps you, an upvote would be appreciated.
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...