How can I format the output from a Splunk query?

[timbCFCA]

How can I format the output from a Splunk query?

For example I have three fields extracted, A, B, C. I'd like to output "For server A service B is in state C". The original format of the log is so horrible (nearly 20 additional fields I don't want) I'd rather not have to have my users have to struggle through reading it in the raw format. The table command doesn't work since how I'm using the output the table headers are useless.

[Ayn · Accepted solution]

You can concatenate strings together to a new field holding the concatenated string using the eval command and then output that using table or however you want to output the field.

<yourbasesearch> 
| eval userfriendlydesc="For server ".A." service ".B." is in state".C
| table userfriendlydesc

If for some reason you don't want to use table you could change the raw message at search time.

<yourbasesearch> 
| eval _raw="For server ".A." service ".B." is in state".C

[timbCFCA]

That is exactly what I was looking for. I hadn't thought about using an eval in that way - I didn't think that the string concatenation like that would work. Many thanks.

[dmaislin_splunk]

Can you show the search command you are currently using and perhaps some sample output?