Splunk Search

Syntax to break a line in search so that it breaks into two lines in servicenow

man03359
Communicator

Hi All,

I have a field called summary in my search -

Failed backup of the transaction log for SQL Server database 'model' from 'WSQL040Q.tkmaxx.tjxcorp.net\\MSSQLSERVER'.

I am creating this search for service-now alert and I am sending this summary field value under comments in ServiceNow.

I need it to break in two lines like this -

Line1-Failed backup of the transaction log for SQL Server database 'model' from
Line2-'WSQL040Q.tkmaxx.tjxcorp.net\\MSSQLSERVER'.

 

How do I implement this in my Search?

Thanks In Advance!

Labels (3)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If SNOW will interpret a newline character as dividing the field into two lines then this may work.

| rex field=summary mode=sed "s/from '(.*)/from\n'\1/"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

Alternatively, if ServiceNow accepts literal newline, you can just insert newline

| eval summary = replace(summary, " from ", " from
")

richgalloway
SplunkTrust
SplunkTrust

If SNOW will interpret a newline character as dividing the field into two lines then this may work.

| rex field=summary mode=sed "s/from '(.*)/from\n'\1/"
---
If this reply helps you, Karma would be appreciated.

man03359
Communicator

@richgalloway  It worked, thanks a lot 🙂

Also, could you please explain it to me, or is there any docs I may refer to?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The rex command can either extract fields from an event or replace text in an event.  In this case, mode=sed tells it to replace text.  The field=summary option restricts the command to the contents of the summary field.

The quoted string is the sed command to execute.  The 's' represents the substitute command.  The part after the first slash is a regular expression.  It says to look for the string "from '" followed by any number of additional characters (.*).  The parentheses create a group we'll refer back to later.  The part after the next slash is the replacement text.  It puts the "from" back, adds a newline character (\n), then adds the remainder of the original text (the group from part 1).

To read more about rex, see the Search Reference manual.  https://docs.splunk.com/Documentation/Splunk/9.2.0/SearchReference/Rex

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...