Splunk Search

named field for indexed data

gekoner
Communicator

I am looking to setup a dashboard that displays data from various indexes. I was looking to just use a data table or event listing. Very Simple layout.
I have the data being returned in the search, but I can't get the contents of the data to display. I'm using "| table _time ..." to sort the data
I think this is because there is no field name for the data. I have tried using _raw but that doesn't work. I can get any of the named fields to display, but what is the correct way to get the data from the event to show the data as it is shown in the raw search. It is all on one line.

EXAMPLE of text returned in the search:
50102:{0x10C} [AUDIT] user.a@email.net - User activated on the server 1234
host=servername sourcetype=APP1 source=F:\Program Files (x86)\APP1\log0001.txt

I know this is simple, I just can't find the correct information on it.

Tags (3)
0 Karma
1 Solution

mw
Splunk Employee
Splunk Employee

If you want to use an Event Listing to just list out the raw events, you shouldn't have the "| table" stuff. Just use the search that shows properly in the flashtimeline and set the element to Event Listing.

View solution in original post

mw
Splunk Employee
Splunk Employee

If you want to use an Event Listing to just list out the raw events, you shouldn't have the "| table" stuff. Just use the search that shows properly in the flashtimeline and set the element to Event Listing.

mw
Splunk Employee
Splunk Employee

Using table will put it in a table. If you just want the raw events, maybe trying using "... | rex mode=sed ..." to keep only what you want.

0 Karma

gekoner
Communicator

mw, I should have been more specific. The reason I was using |table was I wanted to parse the output to only display some of the line. I think the best thing to do is use a regex value in the search parameter.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...