Splunk Search

how to do a line breaking after a string

jip31
Motivator

alt texthello

I need to do a line breaking after "%" and after " on a total of "
| eval Perc=round((NbTOUCHNGOCrashByHost/NbIndHost)*100,1). " %" + " on a total of " + NbIndHost + " machines "

could tyou help me please?

Tags (1)
0 Karma
1 Solution

harshpatel
Contributor

Hi @jip31,

You can use rex command as sed mode to add new line character at two points of your string.
try this:

| makeresults count=1 
| eval Perc=round((NbTOUCHNGOCrashByHost/NbIndHost)*100,1). " %" + " on a total of " + NbIndHost + " machines " 
| rex mode=sed field=Perc "s/%/%\n/g" 
| rex mode=sed field=Perc "s/on a total of/on a total of\n/g"

View solution in original post

0 Karma

harshpatel
Contributor

Hi @jip31,

You can use rex command as sed mode to add new line character at two points of your string.
try this:

| makeresults count=1 
| eval Perc=round((NbTOUCHNGOCrashByHost/NbIndHost)*100,1). " %" + " on a total of " + NbIndHost + " machines " 
| rex mode=sed field=Perc "s/%/%\n/g" 
| rex mode=sed field=Perc "s/on a total of/on a total of\n/g"
0 Karma

jip31
Motivator

Hi

I have changed the sentance:
| eval Perc=round((NbTOUCHNGOCrashByHost/NbIndHost)*100,1). " %" + " / " + NbIndHost + " machines "
but it doesnt works

| eval Perc=round((NbMESCrashByHost/NbIndHost)*100,1). " %" + " / " + NbIndHost + " machines "
| rex mode=sed field=Perc "s/%/%\n/g"
| table Perc

an idea please???

0 Karma

harshpatel
Contributor

Can you tell me what Splunk version you are using? Also, are you displaying this on the dashboard?

0 Karma

jip31
Motivator

To my mind the rex command is not correct

0 Karma

MuS
SplunkTrust
SplunkTrust

you might want to escape the \\ in the sed regex:

| rex mode=sed field=Perc "s/%/%\\n/g" 
| rex mode=sed field=Perc "s/on a total of/on a total of\\n/g"

cheers, MuS

0 Karma

MuS
SplunkTrust
SplunkTrust

it actually works both ways, with or without escaping:

| makeresults 
| eval foo=" need to do a line breaking after % and after \" on a total of \" " 
| rex mode=sed field=foo "s/%/&\n/g" 
| rex mode=sed field=foo "s/on a total of /&\\n/g"

cheers, MuS

0 Karma

jip31
Motivator

like i said earlier I have changed the sentance
now I use it :
| eval Perc=round((NbMESCrashByHost/NbIndHost)*100,1). " %" + " / " + NbIndHost + " machines "

but when I m doing | rex mode=sed field=Perc "s/%/%\n/g" there is always no breakdown...

0 Karma

FrankVl
Ultra Champion

Works fine for me (using exactly the code you posted here): https://imgur.com/VV4Hd2A

Please share a screenshot of your situation.

0 Karma

jip31
Motivator

done
I need / 40 machines under the percentage
I join also the xml piece :
[| inputlookup host.csv
| table host] index="x" sourcetype="PerfmonMk:Process" process_name=chrome ("%_Processor_Time"=0)
| dedup host
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE
| stats count as NbMESCrashByHost by host SITE
| search SITE=$tok_filtersite$
| appendcols
[| inputlookup host.csv
| stats count as NbIndHost]
| eval Perc=round((NbMESCrashByHost/NbIndHost)*100,1). " %" + " / " + NbIndHost + " machines "
| rex mode=sed field=Perc "s/%/%\n/g"
| table Perc

0 Karma

FrankVl
Ultra Champion

Right, so the issue is in displaying it as a single value. Apparently that viz does not support multiple lines. I indeed get the same result. I'm afraid what you want is not possible then. (or at least not with pure simple xml dashboard functionality).

0 Karma

jip31
Motivator

Grrrrrrrrrrrrrr
ok fraanck thanks although

0 Karma

harshpatel
Contributor

Can you tell what value you are getting for Per at the end of eval.

0 Karma

jip31
Motivator

7.0.1 version

0 Karma

martynoconnor
Communicator

When you say line breaking, do you mean in context of event breaking in props.conf?

0 Karma

jip31
Motivator

Not at all

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...