Adding fields to the output of a CLI search

[dmalcor]

In the GUI I get results plus the fields: host, source, and sourcetype
Same search in the CLI I just get results, no fields (even when I ask for "fields":

# splunk search "reboot | fields + source, sourcetype, host"

I'm still very new to this, so I could be missing something really basic.

:-Dan

[dmalcor]

The "table" command gave me the other half. Now I can get the host, source, and sourcetype, but I'm missing the actual search results. I tried adding "_raw", but that just gets me the results (same as before):

# splunk search "reboot | table host, source, _raw"

[somesoni2]

The field picker and the fields index/source/sourcetype is a Splunk GUI feature (provides metadata about the search result) and is not available in Splunk CLI (understandably). If you wish to see these fields into your result, you would have to use search commands like table.

e.g.

# splunk search " your search | table source, sourcetype, host, your other fields from search result"

[dmalcor]

It seem like we can't get the message and the details on the same line. The "" is no different than no "".

[somesoni2]

Try this.

splunk search "reboot| table host, source , *"

This will give all the columns you need. I don't think you would be able to see the event listing (way to see in GUI) + these three additional columns. If you are interested in specific column, specify them in the table command.

[dmalcor]

The "table" command gave me the other half. Now I can get the host, source, and sourcetype, but I'm missing the actual search results. I tried adding "_raw", but that just gets me the results (same as before):

# splunk search "reboot | table host, source, _raw"