Splunk Search

Table does not display correct field spaces

antlefebvre
Communicator

When piping fields into a table, the table eliminates extra spaces inside the field.

For example:

person_name="Smith  MD, John" |table person_name
                  ^^ (Two Spaces)

returns

Smith MD, John
     ^ (One Space)

This is terrible for forms when going from a broad * search to a single name search as copy/paste returns no results.

How do I get a table to return the field with ALL spaces that were in the raw event?

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

The table command isn't to blame, it preserves the double space - HTML's wrapping of multiple spaces into one is to blame.

<tr class="shared-resultstable-resultstablerow" data-cid="view7405" data-view="views/shared/results_table/ResultsTableRow" data-row-index="0" data-render-time="0.001">
  <td data-cell-index="0">
    Smith  MD, John
  </td>
</tr>

As you can see, the double space has made it into the source code, but your browser correctly only renders one space.

You could in principle set the CSS property white-space: pre; for that cell/column, but this would make all the whitespace around the cell appear as well.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

The table command isn't to blame, it preserves the double space - HTML's wrapping of multiple spaces into one is to blame.

<tr class="shared-resultstable-resultstablerow" data-cid="view7405" data-view="views/shared/results_table/ResultsTableRow" data-row-index="0" data-render-time="0.001">
  <td data-cell-index="0">
    Smith  MD, John
  </td>
</tr>

As you can see, the double space has made it into the source code, but your browser correctly only renders one space.

You could in principle set the CSS property white-space: pre; for that cell/column, but this would make all the whitespace around the cell appear as well.

martin_mueller
SplunkTrust
SplunkTrust

The pedant in me would suggest that it's actually faulty data if there's more than one space in there. If your source agrees, you could set up an alert to get those responsible for the data to fix it on their end for greater overall quality - both in Splunk and in the source application.

0 Karma

antlefebvre
Communicator

Crap... thanks for the explanation.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...