Split up long lines of code with line breaks so that the lines of code fit within the page width and don’t extend off the screen.
When deciding where to break a search string, prioritize the break based on the following list:
-
Before a pipe
-
At a space
-
Before an open parenthesis or bracket
-
After a close parenthesis or bracket
-
Before or after an equal sign
-
Before or after any equation symbol, such as *, /, +, >, <, or –
-
After a dot, such as in a URL
Line break example
Consider the following search:
sourcetype=access_* status=200 action=purchase clientip=87.194.216.51 | stats count, distinct_count(productId), values(productId) by clientip
Because this search is longer than one line, a logical place to break this line is between clientip=87.194.216.51 and | stats, rather than between count, and distinct_count(productId).
The break appears as follows:
sourcetype=access_* status=200 action=purchase clientip=87.194.216.51
| stats count, distinct_count(productId), values(productId) by clientip