Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Search formatting in Splunk 6.5.0 for easier r...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I saw a feature in Splunk 6.5.0 where you can press a single button in the search bar and it will autoformat the query so it's far easier to read. Does anyone know what this shortcut is?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The answer that worked for me is kinda buried, so I'll repeat it here. 1password has cmd + \so it moved tocmd + fn + ``
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Issue resolved for me when I learnt that under Splunk user profile's Preferences > Chose SPL Editor > Enable "Advanced editor". You can also enable "Line numbers" and "Search auto-format"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ctrl + | (Ctrl + pipe) Worked for me on Windows 7, Splunk version 6.x and 7.x,Ctrl + | (Ctrl + pipe) worked for me on Windows 7
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ok... again as an answer...
Just checked on Firefox, Windows 10, German keyboard:
Ctrl (Strg) + Shift + F
This should work with nearly all keyboard layouts...
Have fun 😉
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yep thanks, it does the trick.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ctrl+\ its perfectly working in Windows
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Cmd+\ works perfectly on Mac
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
On my "new" OSX 10.14.4 Cmd+\ doesn't work anymore. Ideas?!?
Marco
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what happens? In my case 1password owns the cmd + \ so it moves to fn + cmd + \ . Try that, or turn on auto-format under user prefs. User > prefs > spl editor, as someone mentioned below.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I believe it is Ctrl+\ or Cmd+\
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ctrl + \ doesn't work for me.
I'm on Windows 10 withe splunk enterprise 7.1.1 and on chrome
,ctrl + \ doesnt work on windows for me. I'm on splunk 7.1.1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Windows 10, with Splunk Enterprise Version: 7.1.5 Build: fd4da3d4caf1. Tried with Firefox, Chrome, ctrl + \ does not work for me anymore. Was working on 7.0.3
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you, Ctrl + \ is exactly what I was talking about.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a spanish keyboard, I don't have the "\" key, is there any shortcut for me?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are two defects filed about non-English keyboards and the search formatting: SPL-130405 and SPL-135260. In an upcoming release, there will be an enhancement so that you can use Command-shift-f.
Can you get a backslash by typing Ctrl + alt + "º ª \" (the first key to the left of " 1 ! | " )?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
also be aware (at least on MAC) that browser plugins like 1password etc, may step on the shortcut, so it become fn + cmd + \\
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Documented in Help reading searches in the Search Manual.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please add the alternative keyboard shortcuts for non-us keyboards to trigger formatting.
I'm successfully using Shift+cmd+f on MacOs with a Swedish keyboard. I only knew it from a comment here on the forum, it belongs in the manual.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions
Splunk Community Badges!
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
