- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Keyboard Shortcut to Format Search
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
At .conf this year, a new feature was showed off that allowed auto-formatting of SPL in the search bar with the press of a button in 6.5. It took a search from a single line:
index=myindex | stats count by action
to multiple lines:
index=myindex
| stats count by action
Does anyone know what the key is that accomplishes this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Answer is Ctrl + Shift + F
That will make your SPL neat and clean!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So how about unformatting?
To get everything back into a single line.
This will solve the issue for people that use savedsearches.conf stanza's where formatted code copy pasted from splunk GUI will cause everything after the first PIPE to be ignored by the savedsearch configuration on the search head.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A similar question was asked by a customer who uses a Norwegian Keyboard (below):
https://www.datacal.com/image/popup?imagePath=%2fimages%2fproduct%2flarge%2f310.jpg
There is a §| key above the Tab key (left of the 1) and that produces the \ character within Splunk.
Pressing Ctrl+§| enables Search Bar formatting in Splunk 6.5.x. This was confirmed to work by the customer.
That is the same physical location of the ^ character on a German T2 Keyboard
(See also: https://answers.splunk.com/answers/459003/what-is-the-keyboard-shortcut-for-the-splunk-650-s.html)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OMG I love you so much... I tried all the combinations on my German keyboard to get that feature to work, but this (completely unrelated) key combo works fine. Yeah! 😄
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did someone try this using a Mac and a german keyboard ? Even using BetterTouchTool I'm not able to simulate that shortcut.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
On a Mac /w German keyboard cmd # should do the trick
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for the link! Ctrl+\ did the trick!
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
