topic Is there a way to determine if Splunk results will return in tabular format or raw events format? in Splunk Search

Is there a way to determine if Splunk results will return in tabular format or raw events format?

kunal0311 — Tue, 10 Jan 2017 21:03:09 GMT

Hi All,
I have a requirement to email Splunk results. The problem is some Splunk results are in table format and some are in raw format. How can i determine if the resultset returned is tabular or unformatted raw format? How can i do that using Splunk SDK?

Re: Is there a way to determine if Splunk results will return in tabular format or raw events format?

lguinn2 — Tue, 10 Jan 2017 21:46:02 GMT

If you have transformed the data in any way, the search pipeline will return a table, not the raw events.
If all you have done is filtered the events using search and where commands, then your search will return raw events.

If you want to know which commands transform the data, you might want to start with Types of Commands in the Search Manual.

HTH

Re: Is there a way to determine if Splunk results will return in tabular format or raw events format?

hunters_splunk — Wed, 11 Jan 2017 08:37:41 GMT

Hi kunal0311,

Simply put:

These generating commands generate events or reports from one or more indexes without transforming the events:
http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Commandsbytype#Generating_commands
These transforming command orders the results into a data table:
http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Commandsbytype#Transforming_commands

Hope this helps. Thank!
Hunter

Re: Is there a way to determine if Splunk results will return in tabular format or raw events format?

kunal0311 — Wed, 11 Jan 2017 14:01:40 GMT

Thanks for the response. It was helpful. What i was actually looking for was that is there a way in Java using Splunk SDK to pro grammatically check the Events and identify whether the resultset from splunk is raw or formatted.

Re: Is there a way to determine if Splunk results will return in tabular format or raw events format?

kunal0311 — Wed, 11 Jan 2017 14:01:46 GMT

Re: Is there a way to determine if Splunk results will return in tabular format or raw events format?

dstile — Thu, 11 Oct 2018 02:42:15 GMT

If you haven't already, maybe check out this example:
https://github.com/splunk/splunk-sdk-java/blob/master/examples/com/splunk/examples/search/Program.java

Look at line 103. Couldn't you do something similar to test if there are results in the OutputList array and if not, format as events?