Syntax to break a line in search so that it breaks into two lines in servicenow

[man03359]

Hi All,

I have a field called summary in my search -

Failed backup of the transaction log for SQL Server database 'model' from 'WSQL040Q.tkmaxx.tjxcorp.net\\MSSQLSERVER'.

I am creating this search for service-now alert and I am sending this summary field value under comments in ServiceNow.

I need it to break in two lines like this -

Line1-Failed backup of the transaction log for SQL Server database 'model' from
Line2-'WSQL040Q.tkmaxx.tjxcorp.net\\MSSQLSERVER'.

How do I implement this in my Search?

Thanks In Advance!

[yuanliu]

Alternatively, if ServiceNow accepts literal newline, you can just insert newline

| eval summary = replace(summary, " from ", " from
")

[richgalloway · Accepted solution]

If SNOW will interpret a newline character as dividing the field into two lines then this may work.

| rex field=summary mode=sed "s/from '(.*)/from\n'\1/"

[man03359]

@richgalloway  It worked, thanks a lot 🙂

Also, could you please explain it to me, or is there any docs I may refer to?

[richgalloway]

The rex command can either extract fields from an event or replace text in an event.  In this case, mode=sed tells it to replace text.  The field=summary option restricts the command to the contents of the summary field.

The quoted string is the sed command to execute.  The 's' represents the substitute command.  The part after the first slash is a regular expression.  It says to look for the string "from '" followed by any number of additional characters (.*).  The parentheses create a group we'll refer back to later.  The part after the next slash is the replacement text.  It puts the "from" back, adds a newline character (\n), then adds the remainder of the original text (the group from part 1).

To read more about rex, see the Search Reference manual.  https://docs.splunk.com/Documentation/Splunk/9.2.0/SearchReference/Rex