Hello
I am forwarding remote Linux machines' logs to central splunk; and doing the simple GUI search as below:
source="/var/log/remotelogs" "sudo" earliest=-4hr |table host _raw | dedup host
The results are below: which is CORRECT
++++++++++++++++++++++++++++++++++++++++
host _raw
1 1.1.1.1 Jan 3 15:36:09 1.1.1.1 sudo(pam_unix)[550]: session closed for user root
2 2.2.2.2 Jan 3 15:30:15 2.2.2.2 sudo: root : sorry, you must have a tty to run sudo ; TTY=unknown ; PWD=/root ; USER=root ; COMMAND=/usr/bin/uptime
Whereas I am running the same command in CLI as below:
/var/splunk/bin/splunk search 'source="/var/log/remotelogs" "sudo" earliest=-4hr |table host _raw |dedup host'>1.txt
Now the output of 1.txt is as below: which is NOT CORRECT or SAME as GUI
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Preview of: source="/var/log/remotelogs" "sudo" earliest=-4hr |table host _raw
Jan 3 15:54:19 2.2.2.2 sudo: root : sorry, you must have a tty to run sudo ; TTY=unknown ; PWD=/root ; USER=root ; COMMAND=/usr/bin/upti
me
Jan 3 15:54:15 1.1.1.1 sudo(pam_unix)[7725]: session closed for user root
Preview of: source="/var/log/remotelogs" "sudo" earliest=-4hr |table host _raw
Jan 3 15:54:19 2.2.2.2 sudo: root : sorry, you must have a tty to run sudo ; TTY=unknown ; PWD=/root ; USER=root ; COMMAND=/usr/bin/upti
me
Jan 3 15:54:15 1.1.1.1 sudo(pam_unix)[7725]: session closed for user root
==============================
Questions
1. Why the result is appearing two times
2. also why "Preview of: source="/var/log/remotelogs" "sudo" earliest=-4hr |table host _raw" appearing and that too TWO times?
Can you help
Open Suse Linux 12.2 / RSYSLOG / Splunk version 5.0.1, build 143156
For some reason './splunk search' doesn't like outputting raw in a tabular display.
It seems that if _raw is returned as a field, the output switches to 'raw' mode instead of table (which seems logical)
This works ..
./splunk search 'source="/var/log/remotelogs" "sudo" earliest=-4hr | rename _raw as raw | table host raw | dedup host' -preview false
You might find running ./splunk help search
useful, to see what other options are available to you for formatting etc.
Cool. If this works for you, you could accept the answer. Cheers
Wow,you saved my time. The solution worked like Champion. Thanks a lot Jonuwz