Splunk Search

do we have commad to trim new lines ??

rakesh_498115
Motivator

HI..

I have seen the functions ltrim and rtrim to spaces ..do we have functions to trim new lines..

actually in my fields i am getting data like this..

Field

data

so when i use table command to display...

sourcetype="mydata" | table Field

its displaying like this

Field
data

but when i extract it to a csv file ..those empty line spaces are coming...tried coaselce function also.but no luck...

pls help

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Replace should be able to do this, with an expression like this: "[\n\r]+$"

0 Karma

rakesh_498115
Motivator

Thanx a lot Ayn ..sed is working now 🙂

0 Karma

Ayn
Legend

I'm pretty sure you can't match on anchors like that in regex. You'd need to match against the actual characters, like

rex field=Field mode=sed "s/[\r\n]//g"

rakesh_498115
Motivator

even sed command is not working ...

rex field=Field mode=sed "s/^$//"

pls help

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Works well over here. Make sure there aren't any spaces or other characters after the newlines, else the expression will not match.

As a test, consider removing the dollar sign - that should remove every newline from your field, even non-trailing ones.

0 Karma

rakesh_498115
Motivator

i have used replace function like this ..

eval Field = replace(Field,"[\n\r]+$","") .. but this didnt work ..

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Once should be enough, there's no point in removing trailing newlines again after the first eval.

0 Karma

Ayn
Legend

...or rex mode=sed. I think replace only replaces once.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...