Can the XML REST API _raw field highlighting be turned off?

[beezly]

The XML REST API is returning mangled results. It looks like it is applying some sort of highlighting syntaxt to the _raw field;

The contents of the raw filed have the search string I queried for wrapped by <sg h="1">[query string]</sg>. Is there a way to turn this behaviour off?

[elazaroh]

This is specific to the PowerShell SDK, and somewhat ugly, but might give you some ideas on hacking your way around this quirk.

In Splunk-Search.psm1, on line 142, I changed this:

{$_.k -eq "_raw"}           { $Myobj.Add("raw",$_.v.'#text');continue}

to this:

{$_.k -eq "_raw"}   {
    $rawTemp =  $_.v.OuterXml     
    $rawTemp = $rawTemp -replace "<v xml:space=`"preserve`" trunc=`"0`">", ""    
    $rawTemp = $rawTemp -replace "<sg h=`"1`">", "" 
    $rawTemp = $rawTemp -replace "</sg>", ""   
    $rawTemp = $rawTemp -replace "</v>", ""
    #write-host "rawTemp: $rawTemp";
    $Myobj.Add("raw",$rawTemp);continue}

Good luck

[dwhytock]

Yes, please, on that request. This is greatly interfering with my JAXB handling of the results.

BTW, this was also asked three years ago, in

http://splunk-base.splunk.com/answers/6678/how-do-i-turn-off-highlighting

[Stephen_Sorkin · Accepted solution]

Unfortunately this is not possible. I will file a request on your behalf to allow this.

[araitz]

Sorkin knows best, +1 on the request.