Splunk Search

newline in Splunk query

v709587
Explorer

Hi,

Please help me with a newline command in Splunk query

Tags (1)
0 Karma
1 Solution

harishalipaka
Motivator

[Updated]

hi @v709587 try this below query

|makeresults |eval IMSI1="This is Splunk Dashboard. The list of hosts are as shown."   | makemv delim="." IMSI1 | mvexpand IMSI1 |table IMSI1

if you want to add new row try append, appendpipe

if you want to add new column try appendcols

*********All the Best***********

View solution in original post

0 Karma

harishalipaka
Motivator

[Updated]

hi @v709587 try this below query

|makeresults |eval IMSI1="This is Splunk Dashboard. The list of hosts are as shown."   | makemv delim="." IMSI1 | mvexpand IMSI1 |table IMSI1

if you want to add new row try append, appendpipe

if you want to add new column try appendcols

*********All the Best***********
0 Karma

v709587
Explorer

This works !!!. Thank You

0 Karma

v709587
Explorer

However,
"eval Impact=Column3.Column1" displays "Column1" and "Column3" as result and not the value of those parameters. Please help.

This is my query
|inputlookup file.csv | where Column1="$Column1$" and Column2="$Column2$" | return $Column3 | eval Impact=Column3.Column1 | makemv delim="." Impact | mvexpand Impact | table Impact

0 Karma

v709587
Explorer

$Column1
$Column1$
"$Column1"
"$Column$"

None of the above work.

0 Karma

vnravikumar
Champion

Hi
Can you give more information, what you are really expecting?

0 Karma

v709587
Explorer

eg: "This is Splunk Dashboard. The list of hosts are as shown."

I want to display these 2 lines in 2 different lines within same row, same panel.

0 Karma

vnravikumar
Champion

To understand more clearly, whether it is possible to give mock screenshot.

0 Karma

v709587
Explorer

Thanks Ravi for your help

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...