I have a problem with using the 'escape' character in the Search App and Single Value Visualization.
In an older project, I built a dashboard panel that uses the escape character like this :
index=..... (Data Search Query)
| eval C_FIELD = A_FIELD."#".B_FILED
| fields C_FILED
| rex mode=sed field=C_FILED "s/#/\n/g"
| table C_FILED
That panel used Single Value Visualization, \n character was working as escape character In the Splunk Enterprise 6.2.5 version.
In doing testing that Splunk Enterprise 7.2.x version upgrade job. but, that Visualization was not showing line break, i found that \n is not read as Escape Character. that read blank not Escape Character.
6.2.5 version result and Single Value's result :
10:00:00 ~ 11:00:00
product' informations or comment
7.2.x version :
10:00:00 ~ 11:00:00 product' informations or comment
I know that Single Value Visualization architecture was changed in Splunk Enterprise 6.2.x to 7.x.x version, and In 7.x.x version Single Value Viz was changed text system to canvas system. but i want that panel look like As-Is system's panel in Testing period. so, i searching that solution.
consequently, I want know that how to line change in Single Value Viz : 1) way to use Regular Expression in search 2) way to use Built-in xml option like Element - i wasn't found option In Splunk XML reference Document 3) way to change used CSS, JS file 4) another ways
if you have tips, way, advice, explanation and methods, etc, please help.
... View more