Splunk Search

Replace all newlines anywhere (beginning, middle, end) on field

dojiepreji
Path Finder

Hello all,

I have a field with data that looks like this:

The process has failed. Please review.

Dear Team

Please assign to Team

Process blah blah to blah blah

Please review logs.

Sincerely

Support

I want to remove all linebreaks like so:

The process has failed. Please review blah: Dear Team Please open a new Incident and assign to Team blah Submitted from 1928389112828 blah. Please review attached logs. Sincerely, Support.

I've tried sed to do it: | rex mode=sed field=description "s/(\n+)//g", but the output still has extra spaces at the beginning.
I've also tried trim(description) but it's giving me the same result.

Any help would be appreciated. Thanks.

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval description="The process has failed. Please review.


Dear Team


Please assign to Team


Process blah blah to blah blah


Please review logs.


Sincerely


Support" 
| eval description=replace(description,"(?m)\s+"," ")

HI, @dojiepreji
try (?m)

cf. regex101

0 Karma

manjunathmeti
Champion

Use replace.

| makeresults
| eval description = "The process has failed. Please review.

Dear Team

Please assign to Team

Process blah blah to blah blah

Please review logs.

Sincerely

Support"
| eval description = replace(description, "\n\n", "")

0 Karma

wmyersas
Builder

You're close - you need to change the regex in replace() from "\n\n" to "[\n\r\f]"

Then replace() will change any form of a newline to a blank.

Alternatively, you could do | eval description=replace(replace(description,"[\n\r\f]"," "),"\s{2,}"," ")
Which will replace newlines with a space, and then replace any sequential whitespace with a single space.

0 Karma

dojiepreji
Path Finder

Did not work. Nothing happened to my field.

0 Karma

manjunathmeti
Champion

I am getting the proper result. With above query I got below value for description:

The process has failed. Please review. Dear Team Please assign to Team Process blah blah to blah blah Please review logs. Sincerely Support

0 Karma

dojiepreji
Path Finder

There are multiple line breaks before the line The process has failed.... This might be contributing as to why I'm not getting any changes.

0 Karma
Get Updates on the Splunk Community!

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...