Splunk Search

How can I format the output from a Splunk query?

timbCFCA
Path Finder

How can I format the output from a Splunk query?

For example I have three fields extracted, A, B, C. I'd like to output "For server A service B is in state C". The original format of the log is so horrible (nearly 20 additional fields I don't want) I'd rather not have to have my users have to struggle through reading it in the raw format. The table command doesn't work since how I'm using the output the table headers are useless.

0 Karma
1 Solution

Ayn
Legend

You can concatenate strings together to a new field holding the concatenated string using the eval command and then output that using table or however you want to output the field.

<yourbasesearch> 
| eval userfriendlydesc="For server ".A." service ".B." is in state".C
| table userfriendlydesc

If for some reason you don't want to use table you could change the raw message at search time.

<yourbasesearch> 
| eval _raw="For server ".A." service ".B." is in state".C

View solution in original post

Ayn
Legend

You can concatenate strings together to a new field holding the concatenated string using the eval command and then output that using table or however you want to output the field.

<yourbasesearch> 
| eval userfriendlydesc="For server ".A." service ".B." is in state".C
| table userfriendlydesc

If for some reason you don't want to use table you could change the raw message at search time.

<yourbasesearch> 
| eval _raw="For server ".A." service ".B." is in state".C

timbCFCA
Path Finder

That is exactly what I was looking for. I hadn't thought about using an eval in that way - I didn't think that the string concatenation like that would work. Many thanks.

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Can you show the search command you are currently using and perhaps some sample output?

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...