Splunk Search

Remove spaces in result of format function

BernardEAI
Communicator

I would like to make use of the format function to modify the results of a sub-search. I'm getting spaces in the output that are causing problems with my search.

I'm using CASE in the result to make the search case sensitive. My format function is:

| format "" "CASE(" "" ")" "OR name=" ""

The output of my subsearch is:

CASE( "User 1" ) OR name= CASE( "User 2" ) OR name= CASE( "User 3" ) 

The extra spaces around the search term prevents the CASE function from working. Is there any way to remove these spaces? 

Labels (1)
0 Karma
1 Solution

nickhills
Ultra Champion

This is a limitation of the the "format" command, I am not aware of anyway to prevent it adding spaces between the column/row separators/boundaries.

If my comment helps, please give it a thumbs up!

View solution in original post

nickhills
Ultra Champion

This is a limitation of the the "format" command, I am not aware of anyway to prevent it adding spaces between the column/row separators/boundaries.

If my comment helps, please give it a thumbs up!
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...