Archive
Highlighted

Adding fields to the output of a CLI search

Engager

In the GUI I get results plus the fields: host, source, and sourcetype
Same search in the CLI I just get results, no fields (even when I ask for "fields":

# splunk search "reboot | fields + source, sourcetype, host"

I'm still very new to this, so I could be missing something really basic.

:-Dan

Tags (1)
0 Karma
Highlighted

Re: Adding fields to the output of a CLI search

SplunkTrust
SplunkTrust

The field picker and the fields index/source/sourcetype is a Splunk GUI feature (provides metadata about the search result) and is not available in Splunk CLI (understandably). If you wish to see these fields into your result, you would have to use search commands like table.

e.g.

# splunk search " your search | table source, sourcetype, host, your other fields from search result"
Highlighted

Re: Adding fields to the output of a CLI search

Engager

The "table" command gave me the other half. Now I can get the host, source, and sourcetype, but I'm missing the actual search results. I tried adding "_raw", but that just gets me the results (same as before):

# splunk search "reboot | table host, source, _raw"
0 Karma
Highlighted

Re: Adding fields to the output of a CLI search

SplunkTrust
SplunkTrust

Try this.

splunk search "reboot| table host, source , *"

This will give all the columns you need. I don't think you would be able to see the event listing (way to see in GUI) + these three additional columns. If you are interested in specific column, specify them in the table command.

0 Karma
Highlighted

Re: Adding fields to the output of a CLI search

Engager

It seem like we can't get the message and the details on the same line. The "" is no different than no "".

0 Karma
Highlighted

Re: Adding fields to the output of a CLI search

Engager

The "table" command gave me the other half. Now I can get the host, source, and sourcetype, but I'm missing the actual search results. I tried adding "_raw", but that just gets me the results (same as before):

# splunk search "reboot | table host, source, _raw"
0 Karma