Splunk Search

CLI Search is NOT exactly the same in WEB GUI

arockiam
New Member

Hello
I am forwarding remote Linux machines' logs to central splunk; and doing the simple GUI search as below:
source="/var/log/remotelogs" "sudo" earliest=-4hr |table host _raw | dedup host

The results are below: which is CORRECT
++++++++++++++++++++++++++++++++++++++++
host _raw
1 1.1.1.1 Jan 3 15:36:09 1.1.1.1 sudo(pam_unix)[550]: session closed for user root
2 2.2.2.2 Jan 3 15:30:15 2.2.2.2 sudo: root : sorry, you must have a tty to run sudo ; TTY=unknown ; PWD=/root ; USER=root ; COMMAND=/usr/bin/uptime

Whereas I am running the same command in CLI as below:
/var/splunk/bin/splunk search 'source="/var/log/remotelogs" "sudo" earliest=-4hr |table host _raw |dedup host'>1.txt

Now the output of 1.txt is as below: which is NOT CORRECT or SAME as GUI
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Preview of: source="/var/log/remotelogs" "sudo" earliest=-4hr |table host _raw

Jan 3 15:54:19 2.2.2.2 sudo: root : sorry, you must have a tty to run sudo ; TTY=unknown ; PWD=/root ; USER=root ; COMMAND=/usr/bin/upti
me
Jan 3 15:54:15 1.1.1.1 sudo(pam_unix)[7725]: session closed for user root
Preview of: source="/var/log/remotelogs" "sudo" earliest=-4hr |table host _raw

Jan 3 15:54:19 2.2.2.2 sudo: root : sorry, you must have a tty to run sudo ; TTY=unknown ; PWD=/root ; USER=root ; COMMAND=/usr/bin/upti
me
Jan 3 15:54:15 1.1.1.1 sudo(pam_unix)[7725]: session closed for user root

==============================
Questions
1. Why the result is appearing two times
2. also why "Preview of: source="/var/log/remotelogs" "sudo" earliest=-4hr |table host _raw" appearing and that too TWO times?

Can you help

Platform details

Open Suse Linux 12.2 / RSYSLOG / Splunk version 5.0.1, build 143156

Tags (1)
0 Karma

jonuwz
Influencer

For some reason './splunk search' doesn't like outputting raw in a tabular display.

It seems that if _raw is returned as a field, the output switches to 'raw' mode instead of table (which seems logical)

This works ..

./splunk search 'source="/var/log/remotelogs" "sudo" earliest=-4hr | rename _raw as raw | table host raw | dedup host' -preview false

You might find running ./splunk help search useful, to see what other options are available to you for formatting etc.

jonuwz
Influencer

Cool. If this works for you, you could accept the answer. Cheers

0 Karma

arockiam
New Member

Wow,you saved my time. The solution worked like Champion. Thanks a lot Jonuwz

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...