Splunk Search

How to preserve leading whitespace in a statistcs table?

Path Finder


Take for example the following query:

| makeresults 
| eval somevalue="        Hello World!"
| table somevalue

Notice how "Hello World!" has a bunch of spaces in front of it. When I use the table command the resulting Statistics Table strips out all of the white space:

alt text

Is there a way to preserve this white space so it is included in the table? I know it sounds odd, but for my production data I really need it.


Tags (2)
0 Karma

Esteemed Legend

Upgrade to v7.??? In 7.2 it preserves leading whitespace AND no longer displays newlines as spaces!

0 Karma


Hi @BearMormont
I tested this behavior on different Splunk version and found out that from Splunk version 6.6.xx and above it preserves those spaces and shows in the table.

0 Karma



I checked in Splunk, I'm getting the leading space

alt text