Splunk Search

Search formatting in Splunk 6.5.0 for easier readability

markdflip
Path Finder

I saw a feature in Splunk 6.5.0 where you can press a single button in the search bar and it will autoformat the query so it's far easier to read. Does anyone know what this shortcut is?

Tags (2)
1 Solution

lquinn
Contributor

I believe it is Ctrl+\ or Cmd+\

View solution in original post

jbullough
Path Finder

The answer that worked for me is kinda buried, so I'll repeat it here. 1password has cmd + \so it moved tocmd + fn + ``

swebb07g
Path Finder

Thank you!

0 Karma

lim2
Communicator

Issue resolved for me when I learnt that under Splunk user profile's Preferences > Chose SPL Editor > Enable "Advanced editor". You can also enable "Line numbers" and "Search auto-format"

0 Karma

oztraik
New Member

Ctrl + | (Ctrl + pipe) Worked for me on Windows 7, Splunk version 6.x and 7.x,Ctrl + | (Ctrl + pipe) worked for me on Windows 7

0 Karma

swasserroth
Path Finder

ok... again as an answer...

Just checked on Firefox, Windows 10, German keyboard:
Ctrl (Strg) + Shift + F
This should work with nearly all keyboard layouts...

Have fun 😉

paulito123
Explorer

Yep thanks, it does the trick.

0 Karma

senthilgoa
Engager

Ctrl+\ its perfectly working in Windows

0 Karma

kkrishnan_splun
Splunk Employee
Splunk Employee

Cmd+\ works perfectly on Mac

0 Karma

marcoscala
Builder

On my "new" OSX 10.14.4 Cmd+\ doesn't work anymore. Ideas?!?

Marco

0 Karma

mattymo
Splunk Employee
Splunk Employee

what happens? In my case 1password owns the cmd + \ so it moves to fn + cmd + \ . Try that, or turn on auto-format under user prefs. User > prefs > spl editor, as someone mentioned below.

- MattyMo

lquinn
Contributor

I believe it is Ctrl+\ or Cmd+\

mdepunti
New Member

Ctrl + \ doesn't work for me.

I'm on Windows 10 withe splunk enterprise 7.1.1 and on chrome

,ctrl + \ doesnt work on windows for me. I'm on splunk 7.1.1

0 Karma

lim2
Communicator

Windows 10, with Splunk Enterprise Version: 7.1.5 Build: fd4da3d4caf1. Tried with Firefox, Chrome, ctrl + \ does not work for me anymore. Was working on 7.0.3

0 Karma

markdflip
Path Finder

Thank you, Ctrl + \ is exactly what I was talking about.

0 Karma

sebafdez
Explorer

I have a spanish keyboard, I don't have the "\" key, is there any shortcut for me?

0 Karma

ChrisG
Splunk Employee
Splunk Employee

There are two defects filed about non-English keyboards and the search formatting: SPL-130405 and SPL-135260. In an upcoming release, there will be an enhancement so that you can use Command-shift-f.

Can you get a backslash by typing Ctrl + alt + "º ª \" (the first key to the left of " 1 ! | " )?

0 Karma

mattymo
Splunk Employee
Splunk Employee

also be aware (at least on MAC) that browser plugins like 1password etc, may step on the shortcut, so it become fn + cmd + \\

- MattyMo
0 Karma

ChrisG
Splunk Employee
Splunk Employee

Documented in Help reading searches in the Search Manual.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...