Line breaks

When you include searches in Splunk documentation, split up long lines of code with line breaks so that the lines of code fit within the page width and don't extend off the screen.

When deciding where to break a search string, prioritize the break based on the following list:

1. Before a pipe ( | )
2. At a space
3. Before an open parenthesis ( ( ) or left bracket ( [ )
4. After a close parenthesis ( ) ) or right bracket ( ] )
5. Before or after an equal sign ( = )
6. Before or after any equation symbol, such as an asterisk ( * ), forward slash ( / ), plus sign ( + ), greater than symbol ( > ), less than symbol ( < ), or minus sign ( - )
7. After a dot ( . ), such as in a URL

For more information on formatting searches and other forms of code in Splunk documentation, see Formatting reference.

Line break example

Consider the following search:

sourcetype=access_* status=200 action=purchase clientip=87.194.216.51 | stats count, distinct_count(productId), values(productId) by clientip

Because this search is longer than 1 line, a logical place to break this line is between clientip=87.194.216.51 and | stats, rather than between count, and distinct_count(productId).

The break appears as follows:

sourcetype=access_* status=200 action=purchase clientip=87.194.216.51 | stats count, distinct_count(productId), values(productId) by clientip