Splunk Search

Replace all newlines anywhere (beginning, middle, end) on field

dojiepreji
Path Finder

Hello all,

I have a field with data that looks like this:

The process has failed. Please review.

Dear Team

Please assign to Team

Process blah blah to blah blah

Please review logs.

Sincerely

Support

I want to remove all linebreaks like so:

The process has failed. Please review blah: Dear Team Please open a new Incident and assign to Team blah Submitted from 1928389112828 blah. Please review attached logs. Sincerely, Support.

I've tried sed to do it: | rex mode=sed field=description "s/(\n+)//g", but the output still has extra spaces at the beginning.
I've also tried trim(description) but it's giving me the same result.

Any help would be appreciated. Thanks.

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval description="The process has failed. Please review.


Dear Team


Please assign to Team


Process blah blah to blah blah


Please review logs.


Sincerely


Support" 
| eval description=replace(description,"(?m)\s+"," ")

HI, @dojiepreji
try (?m)

cf. regex101

0 Karma

manjunathmeti
Champion

Use replace.

| makeresults
| eval description = "The process has failed. Please review.

Dear Team

Please assign to Team

Process blah blah to blah blah

Please review logs.

Sincerely

Support"
| eval description = replace(description, "\n\n", "")

0 Karma

wmyersas
Builder

You're close - you need to change the regex in replace() from "\n\n" to "[\n\r\f]"

Then replace() will change any form of a newline to a blank.

Alternatively, you could do | eval description=replace(replace(description,"[\n\r\f]"," "),"\s{2,}"," ")
Which will replace newlines with a space, and then replace any sequential whitespace with a single space.

0 Karma

dojiepreji
Path Finder

Did not work. Nothing happened to my field.

0 Karma

manjunathmeti
Champion

I am getting the proper result. With above query I got below value for description:

The process has failed. Please review. Dear Team Please assign to Team Process blah blah to blah blah Please review logs. Sincerely Support

0 Karma

dojiepreji
Path Finder

There are multiple line breaks before the line The process has failed.... This might be contributing as to why I'm not getting any changes.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...