topic Re: Keyboard Shortcut to Format Search in Splunk Search

Keyboard Shortcut to Format Search

JoshWhaley — Thu, 06 Oct 2016 20:57:50 GMT

At .conf this year, a new feature was showed off that allowed auto-formatting of SPL in the search bar with the press of a button in 6.5. It took a search from a single line:

index=myindex | stats count by action

to multiple lines:



index=myindex

| stats count by action

Does anyone know what the key is that accomplishes this?

Re: Keyboard Shortcut to Format Search

lukejadamec — Thu, 06 Oct 2016 21:02:30 GMT

See the Answer here:
https://answers.splunk.com/answers/456133/search-formatting-in-splunk-650-for-easier-readabi.html

Re: Keyboard Shortcut to Format Search

JoshWhaley — Thu, 06 Oct 2016 21:04:50 GMT

Thank you for the link! Ctrl+\ did the trick!

Re: Keyboard Shortcut to Format Search

tries — Tue, 13 Dec 2016 09:45:51 GMT

Did someone try this using a Mac and a german keyboard ? Even using BetterTouchTool I'm not able to simulate that shortcut.

Re: Keyboard Shortcut to Format Search

christopherr_sp — Thu, 23 Feb 2017 10:12:11 GMT

A similar question was asked by a customer who uses a Norwegian Keyboard (below):

https://www.datacal.com/image/popup?imagePath=%2fimages%2fproduct%2flarge%2f310.jpg

There is a §| key above the Tab key (left of the 1) and that produces the \ character within Splunk.

Pressing Ctrl+§| enables Search Bar formatting in Splunk 6.5.x. This was confirmed to work by the customer.

That is the same physical location of the ^ character on a German T2 Keyboard

https://en.wikipedia.org/wiki/German_keyboard_layout#/media/File:German-T2-Keyboard-Prototype-May-2012.jpg

Re: Keyboard Shortcut to Format Search

bjoernhansen — Fri, 05 May 2017 17:45:48 GMT

OMG I love you so much... I tried all the combinations on my German keyboard to get that feature to work, but this (completely unrelated) key combo works fine. Yeah! 😄

Re: Keyboard Shortcut to Format Search

alai — Thu, 23 May 2019 13:14:57 GMT

On a Mac /w German keyboard cmd # should do the trick

Re: Keyboard Shortcut to Format Search

ramgnisiv — Wed, 16 Oct 2019 12:20:01 GMT

So how about unformatting?

To get everything back into a single line.

This will solve the issue for people that use savedsearches.conf stanza's where formatted code copy pasted from splunk GUI will cause everything after the first PIPE to be ignored by the savedsearch configuration on the search head.

Re: Keyboard Shortcut to Format Search

benspader — Thu, 02 Apr 2020 13:21:23 GMT

Answer is Ctrl + Shift + F
That will make your SPL neat and clean!