Splunk Search

How to preserve leading whitespace in a statistcs table?

BearMormont
Path Finder

Hello!

Take for example the following query:

| makeresults 
| eval somevalue="        Hello World!"
| table somevalue

Notice how "Hello World!" has a bunch of spaces in front of it. When I use the table command the resulting Statistics Table strips out all of the white space:

alt text

Is there a way to preserve this white space so it is included in the table? I know it sounds odd, but for my production data I really need it.

Thanks!

Tags (2)
0 Karma

woodcock
Esteemed Legend

Upgrade to v7.??? In 7.2 it preserves leading whitespace AND no longer displays newlines as spaces!

0 Karma

harshpatel
Contributor

Hi @BearMormont
I tested this behavior on different Splunk version and found out that from Splunk version 6.6.xx and above it preserves those spaces and shows in the table.

0 Karma

vnravikumar
Champion

Hi

I checked in Splunk 7.2.5.1, I'm getting the leading space

alt text

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...