Splunk Search

How do I format Search Processing Language to align the pipes on the left side of the search bar?

Kyle_Jackson
Explorer

How do I format Search Processing Language (SPL) to align the pipes on the left side of the search bar (v 6.5.0)?

hard to read
index=_internal | eval ..... | convert ... | stats... | table ... | sort ...
vs
pretty print


index=_internal
| eval .....
| convert ...
| stats...
| table ...
| sort ...

0 Karma
1 Solution

cmerriman
Super Champion

cmerriman
Super Champion

http://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Parsingsearches#Search_bar_shortcuts

On Linux or Windows use Ctrl + \
On Mac OSX use Command + \

gcusello
SplunkTrust
SplunkTrust

probably you are meaning

index=_internal 
| eval ..... 
| convert ... 
| stats... 
| table ... 
| sort ...

Every way in 6.5 version there is an indentation of all source's tags with the only exception of searches.
If you want to indent also searches (I usually do it!) you have to manually do it.
Fortunately from 6.5 indentation remains also if I enter in Panels search modify, instead in the previous version if you do this you lose indentation.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...