Splunk Search

Replace all newlines anywhere (beginning, middle, end) on field

dojiepreji
Path Finder

Hello all,

I have a field with data that looks like this:

The process has failed. Please review.

Dear Team

Please assign to Team

Process blah blah to blah blah

Please review logs.

Sincerely

Support

I want to remove all linebreaks like so:

The process has failed. Please review blah: Dear Team Please open a new Incident and assign to Team blah Submitted from 1928389112828 blah. Please review attached logs. Sincerely, Support.

I've tried sed to do it: | rex mode=sed field=description "s/(\n+)//g", but the output still has extra spaces at the beginning.
I've also tried trim(description) but it's giving me the same result.

Any help would be appreciated. Thanks.

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval description="The process has failed. Please review.


Dear Team


Please assign to Team


Process blah blah to blah blah


Please review logs.


Sincerely


Support" 
| eval description=replace(description,"(?m)\s+"," ")

HI, @dojiepreji
try (?m)

cf. regex101

0 Karma

manjunathmeti
Champion

Use replace.

| makeresults
| eval description = "The process has failed. Please review.

Dear Team

Please assign to Team

Process blah blah to blah blah

Please review logs.

Sincerely

Support"
| eval description = replace(description, "\n\n", "")

0 Karma

wmyersas
Builder

You're close - you need to change the regex in replace() from "\n\n" to "[\n\r\f]"

Then replace() will change any form of a newline to a blank.

Alternatively, you could do | eval description=replace(replace(description,"[\n\r\f]"," "),"\s{2,}"," ")
Which will replace newlines with a space, and then replace any sequential whitespace with a single space.

0 Karma

dojiepreji
Path Finder

Did not work. Nothing happened to my field.

0 Karma

manjunathmeti
Champion

I am getting the proper result. With above query I got below value for description:

The process has failed. Please review. Dear Team Please assign to Team Process blah blah to blah blah Please review logs. Sincerely Support

0 Karma

dojiepreji
Path Finder

There are multiple line breaks before the line The process has failed.... This might be contributing as to why I'm not getting any changes.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...