Line breaks

Splunk documentation includes search commands. Long lines of code formatted inside of a code phrase don't always fit a reader's set page width and can cause formatting issues. If a line of code is long, use a code block instead of an inline code phrase so that you can control where line breaks occur.

When writing a search command or long line of code inside of a code block, prioritize the line breaks based on the following list:

1. Before a pipe ( | )
2. At a space
3. Before an opening parenthesis ( ( ) or left bracket ( [ )
4. After a closing parenthesis ( ) ) or right bracket ( ] )
5. Before or after an equal sign ( = )
6. Before or after any equation symbol, such as an asterisk ( * ), forward slash ( / ), plus sign ( + ), greater than symbol ( > ), less than symbol ( < ), or minus sign ( - )
7. After a dot ( . ), such as in a URL

For more information on formatting searches and other forms of code in Splunk documentation, see Formatting reference.

Line break example

Consider the following search:

sourcetype=access_* status=200 action=purchase clientip=87.194.216.51 | stats count, distinct_count(productId), values(productId) by clientip

Because this search is longer than 1 line, place it inside of a code block. The logical place to break this line is between clientip=87.194.216.51 and | stats, rather than between count, and distinct_count(productId).

The line break appears as follows:

sourcetype=access_* status=200 action=purchase clientip=87.194.216.51 
| stats count, distinct_count(productId), values(productId) by clientip