topic Re: Modify Splunk Output in Splunk Search

Modify Splunk Output

nielsenr — Wed, 08 Aug 2012 23:52:24 GMT

So here's my problem, I'm using splunk to index some server logs. I am using the splunk javasdk to do a search and get the output as an xml file.
Now my question is can I limit the information splunk sends me? By editing my search I end up getting more information rather than less. For example things like the index and index time are of no use to me. any suggestions?

Re: Modify Splunk Output

wcolgate_splunk — Tue, 14 Aug 2012 18:16:44 GMT

You can use features of the search language to remove unwanted fields from the reports.

For example (the ... is the actual search command like "search index=main *" then "pipe to" using "|".

Remove the "host" and "ip" fields.

... | fields - host, ip

Keep only the "host" and "ip" fields, and display them in the order: "host", "ip".

... | fields host, ip

Keep only the fields 'source', 'sourcetype', 'host', and all fields beginning with 'error'.

... | fields source, sourcetype, host, error*

etcetera. There is a easy-to-digest summary here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchCheatSheet

Re: Modify Splunk Output

wcolgate_splunk — Tue, 14 Aug 2012 18:17:50 GMT

One last thing. In the SDKs a search string always should start with "search ..." The broser GUI always assumes this and puts it there for you.