topic Re: How to show raw data instead of formatted data? in Getting Data In

How to show raw data instead of formatted data?

TitanAE — Tue, 30 Apr 2019 18:43:15 GMT

Hey Everyone,

Bit of a weird question. I'm ingesting a large amount of JSON data into Splunk. However in the Search App I want to default display the data as 'show raw text'. It's a business requirement. How can I achieve this with Splunk.

Re: How to show raw data instead of formatted data?

codebuilder — Tue, 30 Apr 2019 19:28:57 GMT

If I read your question correctly, you want to display the raw data.
It's a bit odd, but easily accomplished:

index=your_index_name | table _raw

Re: How to show raw data instead of formatted data?

TitanAE — Tue, 30 Apr 2019 19:35:33 GMT

Sadly this isn't what I want. What I have is formatted . What I want to do is default the Search and Reporting app's JSON data to just . That way all of my users, who are using to seeing raw text, can search through it like normal.

Not a simple thing to accomplish, surprisingly.

Re: How to show raw data instead of formatted data?

codebuilder — Tue, 30 Apr 2019 19:43:55 GMT

Still a bit confused then. You're ingesting formatted JSON, and want to display it as formatted JSON? Or you want to display it without the tags?

Re: How to show raw data instead of formatted data?

TitanAE — Tue, 30 Apr 2019 19:50:03 GMT

This is what I'm trying to output. Last post didn't reflect this. Also thank you for taking the time to assist with this 🙂

https://imgur.com/a/6825fI8

Re: How to show raw data instead of formatted data?

codebuilder — Tue, 30 Apr 2019 19:56:23 GMT

The pic of your output looks like the raw event from search bar results to me.

Unless I'm still missing something, the data you are seeing is stored in the field _raw.
If you want to add the timestamp as you're seeing in the pic just add _time as well.

index=your_index_name |table _time,_raw

Re: How to show raw data instead of formatted data?

TitanAE — Tue, 30 Apr 2019 19:59:40 GMT

Correct. The results are from the search bar. When I search for a specific sourcetype I receive this:

https://imgur.com/a/JgGmLPV

What I want to default to in the search bar is this:

https://imgur.com/a/6825fI8

That way my users, that are familiar with raw data, can easily and quickly search through something they're familiar seeing.

Re: How to show raw data instead of formatted data?

TitanAE — Tue, 30 Apr 2019 22:59:23 GMT

Correct. The results are from the search bar. When I search for a specific sourcetype I receive this:

https://imgur.com/a/JgGmLPV

What I want to default to in the search bar is this:

https://imgur.com/a/6825fI8

That way my users, that are familiar with raw data, can easily and quickly search through something they're familiar seeing.

Re: How to show raw data instead of formatted data?

lakshman239 — Wed, 30 Sep 2020 00:23:59 GMT

I don't think you have define the display as 'Raw' in the search and reporting app. However, user can choose between Raw, List and Table when they search. The other option would be to create a new 'datasets' definition with something like index=yourindex | table _time, _raw and save it with a meaningful report. The users will see the data appearing as '_raw' when they view this.

Re: How to show raw data instead of formatted data?

soumyasaha25 — Wed, 01 May 2019 10:22:59 GMT

the easiest way to achieve this without any major changes is to click on the "list" dropdown and change it to "raw".

JSON data
Changed to Raw event data