Splunk Search

how to do a line breaking after a string

jip31
Motivator

alt texthello

I need to do a line breaking after "%" and after " on a total of "
| eval Perc=round((NbTOUCHNGOCrashByHost/NbIndHost)*100,1). " %" + " on a total of " + NbIndHost + " machines "

could tyou help me please?

Tags (1)
0 Karma
1 Solution

harshpatel
Contributor

Hi @jip31,

You can use rex command as sed mode to add new line character at two points of your string.
try this:

| makeresults count=1 
| eval Perc=round((NbTOUCHNGOCrashByHost/NbIndHost)*100,1). " %" + " on a total of " + NbIndHost + " machines " 
| rex mode=sed field=Perc "s/%/%\n/g" 
| rex mode=sed field=Perc "s/on a total of/on a total of\n/g"

View solution in original post

0 Karma

harshpatel
Contributor

Hi @jip31,

You can use rex command as sed mode to add new line character at two points of your string.
try this:

| makeresults count=1 
| eval Perc=round((NbTOUCHNGOCrashByHost/NbIndHost)*100,1). " %" + " on a total of " + NbIndHost + " machines " 
| rex mode=sed field=Perc "s/%/%\n/g" 
| rex mode=sed field=Perc "s/on a total of/on a total of\n/g"
0 Karma

jip31
Motivator

Hi

I have changed the sentance:
| eval Perc=round((NbTOUCHNGOCrashByHost/NbIndHost)*100,1). " %" + " / " + NbIndHost + " machines "
but it doesnt works

| eval Perc=round((NbMESCrashByHost/NbIndHost)*100,1). " %" + " / " + NbIndHost + " machines "
| rex mode=sed field=Perc "s/%/%\n/g"
| table Perc

an idea please???

0 Karma

harshpatel
Contributor

Can you tell me what Splunk version you are using? Also, are you displaying this on the dashboard?

0 Karma

jip31
Motivator

To my mind the rex command is not correct

0 Karma

MuS
SplunkTrust
SplunkTrust

you might want to escape the \\ in the sed regex:

| rex mode=sed field=Perc "s/%/%\\n/g" 
| rex mode=sed field=Perc "s/on a total of/on a total of\\n/g"

cheers, MuS

0 Karma

MuS
SplunkTrust
SplunkTrust

it actually works both ways, with or without escaping:

| makeresults 
| eval foo=" need to do a line breaking after % and after \" on a total of \" " 
| rex mode=sed field=foo "s/%/&\n/g" 
| rex mode=sed field=foo "s/on a total of /&\\n/g"

cheers, MuS

0 Karma

jip31
Motivator

like i said earlier I have changed the sentance
now I use it :
| eval Perc=round((NbMESCrashByHost/NbIndHost)*100,1). " %" + " / " + NbIndHost + " machines "

but when I m doing | rex mode=sed field=Perc "s/%/%\n/g" there is always no breakdown...

0 Karma

FrankVl
Ultra Champion

Works fine for me (using exactly the code you posted here): https://imgur.com/VV4Hd2A

Please share a screenshot of your situation.

0 Karma

jip31
Motivator

done
I need / 40 machines under the percentage
I join also the xml piece :
[| inputlookup host.csv
| table host] index="x" sourcetype="PerfmonMk:Process" process_name=chrome ("%_Processor_Time"=0)
| dedup host
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE
| stats count as NbMESCrashByHost by host SITE
| search SITE=$tok_filtersite$
| appendcols
[| inputlookup host.csv
| stats count as NbIndHost]
| eval Perc=round((NbMESCrashByHost/NbIndHost)*100,1). " %" + " / " + NbIndHost + " machines "
| rex mode=sed field=Perc "s/%/%\n/g"
| table Perc

0 Karma

FrankVl
Ultra Champion

Right, so the issue is in displaying it as a single value. Apparently that viz does not support multiple lines. I indeed get the same result. I'm afraid what you want is not possible then. (or at least not with pure simple xml dashboard functionality).

0 Karma

jip31
Motivator

Grrrrrrrrrrrrrr
ok fraanck thanks although

0 Karma

harshpatel
Contributor

Can you tell what value you are getting for Per at the end of eval.

0 Karma

jip31
Motivator

7.0.1 version

0 Karma

martynoconnor
Communicator

When you say line breaking, do you mean in context of event breaking in props.conf?

0 Karma

jip31
Motivator

Not at all

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...