topic Re: How can I format the output from a Splunk query? in Splunk Search

How can I format the output from a Splunk query?

timbCFCA — Thu, 18 Aug 2011 15:22:27 GMT

How can I format the output from a Splunk query?

For example I have three fields extracted, A, B, C. I'd like to output "For server A service B is in state C". The original format of the log is so horrible (nearly 20 additional fields I don't want) I'd rather not have to have my users have to struggle through reading it in the raw format. The table command doesn't work since how I'm using the output the table headers are useless.

Re: How can I format the output from a Splunk query?

dmaislin_splunk — Thu, 18 Aug 2011 15:44:58 GMT

Can you show the search command you are currently using and perhaps some sample output?

Re: How can I format the output from a Splunk query?

Ayn — Thu, 18 Aug 2011 16:09:26 GMT

You can concatenate strings together to a new field holding the concatenated string using the eval command and then output that using table or however you want to output the field.

<yourbasesearch> 
| eval userfriendlydesc="For server ".A." service ".B." is in state".C
| table userfriendlydesc

If for some reason you don't want to use table you could change the raw message at search time.

<yourbasesearch> 
| eval _raw="For server ".A." service ".B." is in state".C

Re: How can I format the output from a Splunk query?

timbCFCA — Fri, 19 Aug 2011 13:34:39 GMT

That is exactly what I was looking for. I hadn't thought about using an eval in that way - I didn't think that the string concatenation like that would work. Many thanks.