Splunk Search

How to preserve leading whitespace in a statistcs table?

BearMormont
Path Finder

Hello!

Take for example the following query:

| makeresults 
| eval somevalue="        Hello World!"
| table somevalue

Notice how "Hello World!" has a bunch of spaces in front of it. When I use the table command the resulting Statistics Table strips out all of the white space:

alt text

Is there a way to preserve this white space so it is included in the table? I know it sounds odd, but for my production data I really need it.

Thanks!

Tags (2)
0 Karma

woodcock
Esteemed Legend

Upgrade to v7.??? In 7.2 it preserves leading whitespace AND no longer displays newlines as spaces!

0 Karma

harshpatel
Contributor

Hi @BearMormont
I tested this behavior on different Splunk version and found out that from Splunk version 6.6.xx and above it preserves those spaces and shows in the table.

0 Karma

vnravikumar
Champion

Hi

I checked in Splunk 7.2.5.1, I'm getting the leading space

alt text

Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...