- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Search formatting in Splunk 6.5.0 for easier r...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I saw a feature in Splunk 6.5.0 where you can press a single button in the search bar and it will autoformat the query so it's far easier to read. Does anyone know what this shortcut is?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The answer that worked for me is kinda buried, so I'll repeat it here. 1password has cmd + \so it moved tocmd + fn + ``
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Issue resolved for me when I learnt that under Splunk user profile's Preferences > Chose SPL Editor > Enable "Advanced editor". You can also enable "Line numbers" and "Search auto-format"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ctrl + | (Ctrl + pipe) Worked for me on Windows 7, Splunk version 6.x and 7.x,Ctrl + | (Ctrl + pipe) worked for me on Windows 7
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ok... again as an answer...
Just checked on Firefox, Windows 10, German keyboard:
Ctrl (Strg) + Shift + F
This should work with nearly all keyboard layouts...
Have fun 😉
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yep thanks, it does the trick.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ctrl+\ its perfectly working in Windows
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Cmd+\ works perfectly on Mac
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
On my "new" OSX 10.14.4 Cmd+\ doesn't work anymore. Ideas?!?
Marco
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what happens? In my case 1password owns the cmd + \ so it moves to fn + cmd + \ . Try that, or turn on auto-format under user prefs. User > prefs > spl editor, as someone mentioned below.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I believe it is Ctrl+\ or Cmd+\
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ctrl + \ doesn't work for me.
I'm on Windows 10 withe splunk enterprise 7.1.1 and on chrome
,ctrl + \ doesnt work on windows for me. I'm on splunk 7.1.1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Windows 10, with Splunk Enterprise Version: 7.1.5 Build: fd4da3d4caf1. Tried with Firefox, Chrome, ctrl + \ does not work for me anymore. Was working on 7.0.3
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you, Ctrl + \ is exactly what I was talking about.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a spanish keyboard, I don't have the "\" key, is there any shortcut for me?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are two defects filed about non-English keyboards and the search formatting: SPL-130405 and SPL-135260. In an upcoming release, there will be an enhancement so that you can use Command-shift-f.
Can you get a backslash by typing Ctrl + alt + "º ª \" (the first key to the left of " 1 ! | " )?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
also be aware (at least on MAC) that browser plugins like 1password etc, may step on the shortcut, so it become fn + cmd + \\
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Documented in Help reading searches in the Search Manual.
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
