topic Re: remove _raw field from table view in Splunk Search

remove _raw field from table view

lutel — Thu, 03 May 2012 14:47:24 GMT

Is it possible to remove _raw field from search results in table view? I guess this change came with Splunk 4.3. ... | fields - _raw is not an option, as i'd like to get to default behaviour from Splunk 4.2 which was not cluttering search results in table view...

Re: remove _raw field from table view

ziegfried — Thu, 03 May 2012 16:15:13 GMT

You could use the table command. You will still be able to view the raw text in the eventsviewer and additionally have a (transformed) results table to look at fields of interest.

... | table host user some_other_field ...

Re: remove _raw field from table view

lutel — Thu, 03 May 2012 16:32:28 GMT

Thank you for prompt response, but this is no option for me, as i want to remove this _raw fields from all the results from different indexes in this view, also i want to have it to be default for all the users. This _raw field breaks formatting and makes output ugly. This is really step backward from version 4.2 😞

Re: remove _raw field from table view

kristian_kolb — Thu, 03 May 2012 18:57:56 GMT

This sounds weird. Perhaps we're misunderstanding what you're trying to do. Please post

a) your search
b) your output
c) your desired output

That way we'd be able to help you better

Re: remove _raw field from table view

lutel — Fri, 04 May 2012 07:13:20 GMT

a) search query doesn't matter, _raw field always appears in "Table" view of main search output (with exception of ... | fields - _raw)
b) output - log entries split into fields but with undesired _raw field...
c) output without this _raw field....

Re: remove _raw field from table view

kristian_kolb — Fri, 04 May 2012 07:25:43 GMT

Sorry, but I still don't understand your problem.

As ziegfried says above, ... | table field1 field2 does not include _raw in the table.

Perhaps we have a different understanding of what "table view" means?
/k

Re: remove _raw field from table view

lutel — Fri, 04 May 2012 07:56:16 GMT

In the results window, you can switch between "events lists", "table" and "results chart" (three icons in the results window) - i'm refering to this "table" view... I don't want to modify each query for this, "... | fields - _raw" gives me desired output, but i want to have this behaviour by default... As it was in 4.2...

Re: remove _raw field from table view

kristian_kolb — Fri, 04 May 2012 08:07:45 GMT

Aah, I see.. Didn't know that any default behaviour had changed. Perhaps there is some system-wide setting that can be configured to alter this.

In the mean time, why not use the fields or table approach to get the results you need/want.

Re: remove _raw field from table view

ziegfried — Fri, 04 May 2012 08:27:16 GMT

You could use the following Javascript code to hide the _raw field from all SimpleResultsTables in an app:

if(Splunk.Module.SimpleResultsTable) {
    var orig = Splunk.Module.SimpleResultsTable.prototype.onResultsRendered;
    Splunk.Module.SimpleResultsTable.prototype.onResultsRendered = function() {
        orig.call(this);
        $('th', this.container).each(function(i, el){
            if(/^_raw\s*$/.test($(el).text())) $(el).hide();
        });
        $('td[field=_raw]', this.container).hide();
    }
}

Simply place this code in $SPLUNK_HOME/etc/apps/search/appserver/static/application.js (Or any other app, where you want to hide the _raw field).

Re: remove _raw field from table view

Drainy — Fri, 04 May 2012 08:31:16 GMT

Hah! Snap, I was just writing up the same (similar) piece of code

Re: remove _raw field from table view

lutel — Fri, 04 May 2012 09:35:54 GMT

Thank you for this code! Could you tell me how can i activate it in default installation? I've copied it as you wrote to $SPLUNK_HOME/etc/apps/search/appserver/static/application.js but this file is not included when the page loads...

Re: remove _raw field from table view

ziegfried — Fri, 04 May 2012 09:37:28 GMT

You have to restart splunkweb. $ splunk restart splunkweb

Re: remove _raw field from table view

ziegfried — Fri, 04 May 2012 09:37:50 GMT

And make sure you clear the browser cache.

Re: remove _raw field from table view

lutel — Fri, 04 May 2012 09:38:43 GMT

im not using fields approach as my installation is used by other users and i want to keep it as simple and clean as possible for them. I've got a lot of extracted fields in each event and this _raw field makes the output ugly now:(

Re: remove _raw field from table view

lutel — Fri, 04 May 2012 09:47:33 GMT

Works like a charm! Thank you for this piece of code!