I need to replace special characters with a line return command but I am having difficulty getting the rex mode=sed working correctly -
example foo fields
| rex field=foo mode=sed "s/(".+?$.+?")/\n/g"
Many thanks for any help you could provide
index=foobar | eval s1= section.";".Name.";".Code | eval s2=crit.";".critname | stats values(Number) as Number by s2 s1 | eval s2 = split(s2,";"), s1 = split(s1,";") | chart values(Number) as Number over s2 by s1 useother=f usenull=f
Here is for search query.
I see the multiple values are automatically expanded.
Can you please try this rex command?
| rex field=foo mode=sed "s/\$/\n/g"
| makeresults | eval foo="hr$D362$processing" | rex field=foo mode=sed "s/\$/\n/g"
|eval s1= section.";".Name.";".Code
|stats values(Number) as Number by s2 s1
| rex field=s2 mode=sed "s/\;/\n/g"
| rex field=s1 mode=sed "s/\;/\n/g"
|chart values(Number) over sepa2 by sepa useother=f usenull=f
Interestingly when I 'inspect' the graph it looks like there is a line break but splunk is showing it as a space in the chart