topic Re: Can the XML REST API _raw field highlighting be turned off? in Dashboards & Visualizations

Can the XML REST API _raw field highlighting be turned off?

beezly — Mon, 23 Apr 2012 15:26:12 GMT

The XML REST API is returning mangled results. It looks like it is applying some sort of highlighting syntaxt to the _raw field;

The contents of the raw filed have the search string I queried for wrapped by <sg h="1">[query string]</sg>. Is there a way to turn this behaviour off?

Re: Can the XML REST API _raw field highlighting be turned off?

Stephen_Sorkin — Mon, 23 Apr 2012 18:48:17 GMT

Unfortunately this is not possible. I will file a request on your behalf to allow this.

Re: Can the XML REST API _raw field highlighting be turned off?

araitz — Tue, 24 Apr 2012 03:24:47 GMT

Sorkin knows best, +1 on the request.

Re: Can the XML REST API _raw field highlighting be turned off?

dwhytock — Wed, 19 Jun 2013 19:04:02 GMT

Yes, please, on that request. This is greatly interfering with my JAXB handling of the results.

BTW, this was also asked three years ago, in

http://splunk-base.splunk.com/answers/6678/how-do-i-turn-off-highlighting

Re: Can the XML REST API _raw field highlighting be turned off?

elazaroh — Wed, 16 Apr 2014 20:19:53 GMT

This is specific to the PowerShell SDK, and somewhat ugly, but might give you some ideas on hacking your way around this quirk.

In Splunk-Search.psm1, on line 142, I changed this:

{$_.k -eq "_raw"}           { $Myobj.Add("raw",$_.v.'#text');continue}

to this:

{$_.k -eq "_raw"}   {
    $rawTemp =  $_.v.OuterXml     
    $rawTemp = $rawTemp -replace "<v xml:space=`"preserve`" trunc=`"0`">", ""    
    $rawTemp = $rawTemp -replace "<sg h=`"1`">", "" 
    $rawTemp = $rawTemp -replace "</sg>", ""   
    $rawTemp = $rawTemp -replace "</v>", ""
    #write-host "rawTemp: $rawTemp";
    $Myobj.Add("raw",$rawTemp);continue}

Good luck