Splunk Search

Is there a way to format results?

Path Finder

I was wondering if there's some configuration that I can apply process the results that are saved on disk to follow a specific schema.

For example, if my saved search is monitoring some csv log file, would I be able to make the results that are written to disk to follow some custom XML schema?

Thanks

0 Karma
1 Solution

Path Finder

I found that this can be done using the "eval" function in my search query to format how _raw will look.

View solution in original post

0 Karma

Path Finder

I found that this can be done using the "eval" function in my search query to format how _raw will look.

View solution in original post

0 Karma