inserting newline, tab into eval-ed field

[gliptak]

Running

| makeresults | eval s="foo\nbar"

 displays

foo\nbar

and it is unclear if the variable has a newline or just contains "\n"

Is this the right syntax to insert newline (tab)?

[ITWhisperer]

| makeresults | eval s="foo
bar"

[gliptak]

The gets me part way there. Shift-Enter works for newline. Would you also have a pointer for inserting Tab?

[ITWhisperer · Accepted solution]

copy and paste from notepad or something like that

[yuanliu]

A really neat trick I keep forgetting!  To insert literal newline without external editor/copy-n-paste, you can use "ctrl + <enter>" in SPL search editor.