Splunk Search
Highlighted

Replace a character with a linebreak in table results

Contributor

I would like to replace all characters "___" in a certain field with a linebreak in my Table module.

I am currently using the following code

eval n=replace(my_field, "___", "\n")

It does not treat \n as a newline. How do I let Splunk know I want a linebreak

Tags (2)
0 Karma
Highlighted

Re: Replace a character with a linebreak in table results

Legend

Indent code blocks with 4 spaces on each line (or click the "1010101" button which does this for you). This will make code show up properly on the site. I fixed this for you this time though.

0 Karma
Highlighted
Highlighted

Re: Replace a character with a linebreak in table results

Contributor

Thanks, just as a note, the mvjoin requires the eval statement in front of it.

0 Karma
Highlighted

Re: Replace a character with a linebreak in table results

Legend

Thanks, nice catch. Fixed.

0 Karma
Highlighted

Re: Replace a character with a linebreak in table results

Communicator

The second answer here http://splunk-base.splunk.com/answers/41691/add-newline-into-table-cell

Which says use split. That worked for me. Rex mode=sed doesn't work for me.

0 Karma
Highlighted

Re: Replace a character with a linebreak in table results

New Member

If this helps anyone, I solved this using a streamstats which always resets:

...
| streamstats reset_before="1=1" list(mvfield) as mvfield
| table mvfield
0 Karma