Splunk Search

Does anyone already have a Formatter (User defined language) for Splunk search text or dashboard XMLs on Eclipse or Notepad++?

koprai
Explorer

Searched a bit, but could find anything. Does anyone already have a Formatter for Splunk search text or Splunk dashboard XMLs (that include prettying the embedded search elements). Ideal if it is pluggable with Notepad++ or Eclipse.

Even though I write the searchTemplate and searchPostProcesses with proper indentation and line breaks on the dashboard XML, when I explore the search via the panel, the search indentations get lost. Indentations also get lost if dashboard.xml gets overwritten as a result of panel edits. Without indentation and formatting, it is very difficult to understand complicated queries.

A formatter that does indentation and line-breaks based on “|” and “[“ and “]” would be great. I know it is possible to define User Defined Language formatter in notepad++ and Eclipse. I wanted to know if someone already has it or if there is a Splunk Formatted App.. IMO native search text formatting should be a feature request for Splunk (both in dashboard XMLs and in search box)

mew1033
Explorer

I found one here: http://www.bbosearch.com/pretty
I'd really like to turn it into a sublime plugin or something...

0 Karma

MuS
SplunkTrust
SplunkTrust

not an real answer to your question but nice anyways https://github.com/yorokobi/vim-splunk

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...