how to do a line breaking after a string

[jip31]

hello

I need to do a line breaking after "%" and after " on a total of "
| eval Perc=round((NbTOUCHNGOCrashByHost/NbIndHost)*100,1). " %" + " on a total of " + NbIndHost + " machines "

could tyou help me please?

[harshpatel · Accepted solution]

Hi @jip31,

You can use rex command as sed mode to add new line character at two points of your string.
try this:

| makeresults count=1 
| eval Perc=round((NbTOUCHNGOCrashByHost/NbIndHost)*100,1). " %" + " on a total of " + NbIndHost + " machines " 
| rex mode=sed field=Perc "s/%/%\n/g" 
| rex mode=sed field=Perc "s/on a total of/on a total of\n/g"

[jip31]

Hi

I have changed the sentance:
| eval Perc=round((NbTOUCHNGOCrashByHost/NbIndHost)*100,1). " %" + " / " + NbIndHost + " machines "
but it doesnt works

| eval Perc=round((NbMESCrashByHost/NbIndHost)*100,1). " %" + " / " + NbIndHost + " machines "
| rex mode=sed field=Perc "s/%/%\n/g"
| table Perc

an idea please???

[harshpatel]

Can you tell me what Splunk version you are using? Also, are you displaying this on the dashboard?

[jip31]

To my mind the rex command is not correct

[MuS]

you might want to escape the \\ in the sed regex:

| rex mode=sed field=Perc "s/%/%\\n/g" 
| rex mode=sed field=Perc "s/on a total of/on a total of\\n/g"

cheers, MuS

[MuS]

it actually works both ways, with or without escaping:

| makeresults 
| eval foo=" need to do a line breaking after % and after \" on a total of \" " 
| rex mode=sed field=foo "s/%/&\n/g" 
| rex mode=sed field=foo "s/on a total of /&\\n/g"

cheers, MuS

[jip31]

like i said earlier I have changed the sentance
now I use it :
| eval Perc=round((NbMESCrashByHost/NbIndHost)*100,1). " %" + " / " + NbIndHost + " machines "

but when I m doing | rex mode=sed field=Perc "s/%/%\n/g" there is always no breakdown...

[FrankVl]

Works fine for me (using exactly the code you posted here): https://imgur.com/VV4Hd2A

Please share a screenshot of your situation.

[jip31]

done
I need / 40 machines under the percentage
I join also the xml piece :
[| inputlookup host.csv
| table host] index="x" sourcetype="PerfmonMk:Process" process_name=chrome ("%_Processor_Time"=0)
| dedup host
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE
| stats count as NbMESCrashByHost by host SITE
| search SITE=$tok_filtersite$
| appendcols
[| inputlookup host.csv
| stats count as NbIndHost]
| eval Perc=round((NbMESCrashByHost/NbIndHost)*100,1). " %" + " / " + NbIndHost + " machines "
| rex mode=sed field=Perc "s/%/%\n/g"
| table Perc

[FrankVl]

Right, so the issue is in displaying it as a single value. Apparently that viz does not support multiple lines. I indeed get the same result. I'm afraid what you want is not possible then. (or at least not with pure simple xml dashboard functionality).

[jip31]

Grrrrrrrrrrrrrr
ok fraanck thanks although

[harshpatel]

Can you tell what value you are getting for Per at the end of eval.

[jip31]

7.0.1 version

[martynoconnor]

When you say line breaking, do you mean in context of event breaking in props.conf?

[jip31]

Not at all