add multiple spaces for fields

[sfatnass]

hi i want to add multiple space for a fields
i tried to use :
| eval fieldname1= fieldname2 . " " . fieldname3

but splunk show only one space and not more

how can i do to specify more spaces
thx

[jotne]

Old question, but needs a better answer 🙂

You can use a non-breaking-space  alt 255

Here you have 10 of them between START-END

START          END

So if you like nice space between one field combined from two. add enough blank at end and then cut all equally long.

| eval eventid=eventid."                  "
| eval eventid=substr(eventid,1,29)
| eval message1=eventid.message

[TStrauch]

Hi,

the multiple spaces are written to the source code. But html is wrapping multiple whitespaces as one. Its not a problem of splunk its simple html crap.

Means. You have your Spaces in the data. But its not correctly displayed in Browser.

Hope this helps.

Kind regards

[woodcock]

The same thing happens with newlines inside of the fields (values), too! This frustrates me.

[sfatnass]

TStrauch i think you don't understand my aim.
my objectif :
if x is a space.
| eval fieldname1= fieldname2 . "xxxxxxxx" . fieldname3

[TStrauch]

I understand your aim. And its like i explained to you.

Ok lets try this. Take you | eval fieldname1= fieldname2 . "xxxxxxxx" . fieldname3
Start your search.
klick on the interesting fields and klick on fieldname1
take one of the top 10 values and drill down on it.
Your search string will show the spaces.

Your spaces are in your data. They are simply not displayed correctly.

You have a html problem. there are ways like css options "white-space: pre;" or something to display the white spaces.

[TStrauch]

http://www.w3schools.com/cssref/pr_text_white-space.asp

[sfatnass]

ok but what is the balise can i call on my css to specify for my dashboard
white-space:pre;

i see what do you mean, but have you a solution to resolve within dashboard ?

[MaryvonneMB]

Maybe use underscores instead of spaces? I'm surprising that you want to use multiple spaces.

[sfatnass]

i only follow the orders

[gcusello]

try
| eval fieldname1= fieldname2+" "+fieldname3
Bye.
Giuseppe

[sfatnass]

same way splunk show only one space not more
my objectif :
if x is a space.
| eval fieldname1= fieldname2 . "xxxxxxxx" . fieldname3