Replace a character with a linebreak in table results

[cmak]

I would like to replace all characters "___" in a certain field with a linebreak in my Table module.

I am currently using the following code

eval n=replace(my_field, "___", "\n")

It does not treat \n as a newline. How do I let Splunk know I want a linebreak

[mmol]

The links to the 'other' questions/answers do not work anymore.

But what does work is:

| eval n=replace(my__field, "___", "
")

 So literally add a newline to your code.

It is silly to need to do it in this way. Why are \n and similar characters as replacements not supported, while they are supported in the pattern. The replace function should also allow other options like replace only one occurrence or all occurrences (learn a bit from the Perl language I guess...)

[afreidin]

If this helps anyone, I solved this using a streamstats which always resets:

...
| streamstats reset_before="1=1" list(mvfield) as mvfield
| table mvfield

[Ayn · Accepted solution]

See answers to the following questions:
http://splunk-base.splunk.com/answers/40033/add-line-breaks-with-eval
http://splunk-base.splunk.com/answers/41691/add-newline-into-table-cell

[ZacEsa]

The second answer here http://splunk-base.splunk.com/answers/41691/add-newline-into-table-cell

Which says use split. That worked for me. Rex mode=sed doesn't work for me.

[Ayn]

Thanks, nice catch. Fixed.

[cmak]

Thanks, just as a note, the mvjoin requires the eval statement in front of it.

[Ayn]

Indent code blocks with 4 spaces on each line (or click the "1010101" button which does this for you). This will make code show up properly on the site. I fixed this for you this time though.