CLI Search is NOT exactly the same in WEB GUI

[arockiam]

Hello
I am forwarding remote Linux machines' logs to central splunk; and doing the simple GUI search as below:
source="/var/log/remotelogs" "sudo" earliest=-4hr |table host _raw | dedup host

The results are below: which is CORRECT
++++++++++++++++++++++++++++++++++++++++
host _raw
1 1.1.1.1 Jan 3 15:36:09 1.1.1.1 sudo(pam_unix)[550]: session closed for user root
2 2.2.2.2 Jan 3 15:30:15 2.2.2.2 sudo: root : sorry, you must have a tty to run sudo ; TTY=unknown ; PWD=/root ; USER=root ; COMMAND=/usr/bin/uptime

Whereas I am running the same command in CLI as below:
/var/splunk/bin/splunk search 'source="/var/log/remotelogs" "sudo" earliest=-4hr |table host _raw |dedup host'>1.txt

Now the output of 1.txt is as below: which is NOT CORRECT or SAME as GUI
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Preview of: source="/var/log/remotelogs" "sudo" earliest=-4hr |table host _raw

Jan 3 15:54:19 2.2.2.2 sudo: root : sorry, you must have a tty to run sudo ; TTY=unknown ; PWD=/root ; USER=root ; COMMAND=/usr/bin/upti
me
Jan 3 15:54:15 1.1.1.1 sudo(pam_unix)[7725]: session closed for user root
Preview of: source="/var/log/remotelogs" "sudo" earliest=-4hr |table host _raw

Jan 3 15:54:19 2.2.2.2 sudo: root : sorry, you must have a tty to run sudo ; TTY=unknown ; PWD=/root ; USER=root ; COMMAND=/usr/bin/upti
me
Jan 3 15:54:15 1.1.1.1 sudo(pam_unix)[7725]: session closed for user root

==============================
Questions
1. Why the result is appearing two times
2. also why "Preview of: source="/var/log/remotelogs" "sudo" earliest=-4hr |table host _raw" appearing and that too TWO times?

Can you help

Platform details

Open Suse Linux 12.2 / RSYSLOG / Splunk version 5.0.1, build 143156

[jonuwz]

For some reason './splunk search' doesn't like outputting raw in a tabular display.

It seems that if _raw is returned as a field, the output switches to 'raw' mode instead of table (which seems logical)

This works ..

./splunk search 'source="/var/log/remotelogs" "sudo" earliest=-4hr | rename _raw as raw | table host raw | dedup host' -preview false

You might find running ./splunk help search useful, to see what other options are available to you for formatting etc.

[jonuwz]

Cool. If this works for you, you could accept the answer. Cheers

[arockiam]

Wow,you saved my time. The solution worked like Champion. Thanks a lot Jonuwz