How do I format Search Processing Language (SPL) to align the pipes on the left side of the search bar (v 6.5.0)?
hard to read
index=_internal | eval ..... | convert ... | stats... | table ... | sort ...
vs
pretty print
index=_internal
| eval .....
| convert ...
| stats...
| table ...
| sort ...
http://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Parsingsearches#Search_bar_shortcuts
On Linux or Windows use Ctrl + \
On Mac OSX use Command + \
http://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Parsingsearches#Search_bar_shortcuts
On Linux or Windows use Ctrl + \
On Mac OSX use Command + \
probably you are meaning
index=_internal
| eval .....
| convert ...
| stats...
| table ...
| sort ...
Every way in 6.5 version there is an indentation of all source's tags with the only exception of searches.
If you want to indent also searches (I usually do it!) you have to manually do it.
Fortunately from 6.5 indentation remains also if I enter in Panels search modify, instead in the previous version if you do this you lose indentation.
Bye.
Giuseppe