Table does not display correct field spaces

[antlefebvre]

When piping fields into a table, the table eliminates extra spaces inside the field.

For example:

person_name="Smith  MD, John" |table person_name
                  ^^ (Two Spaces)

returns

Smith MD, John
     ^ (One Space)

This is terrible for forms when going from a broad * search to a single name search as copy/paste returns no results.

How do I get a table to return the field with ALL spaces that were in the raw event?

[martin_mueller · Accepted solution]

The table command isn't to blame, it preserves the double space - HTML's wrapping of multiple spaces into one is to blame.

<tr class="shared-resultstable-resultstablerow" data-cid="view7405" data-view="views/shared/results_table/ResultsTableRow" data-row-index="0" data-render-time="0.001">
  <td data-cell-index="0">
    Smith  MD, John
  </td>
</tr>

As you can see, the double space has made it into the source code, but your browser correctly only renders one space.

You could in principle set the CSS property white-space: pre; for that cell/column, but this would make all the whitespace around the cell appear as well.

[martin_mueller]

The pedant in me would suggest that it's actually faulty data if there's more than one space in there. If your source agrees, you could set up an alert to get those responsible for the data to fix it on their end for greater overall quality - both in Splunk and in the source application.

[antlefebvre]

Crap... thanks for the explanation.