Splunk Search

named field for indexed data

gekoner
Communicator

I am looking to setup a dashboard that displays data from various indexes. I was looking to just use a data table or event listing. Very Simple layout.
I have the data being returned in the search, but I can't get the contents of the data to display. I'm using "| table _time ..." to sort the data
I think this is because there is no field name for the data. I have tried using _raw but that doesn't work. I can get any of the named fields to display, but what is the correct way to get the data from the event to show the data as it is shown in the raw search. It is all on one line.

EXAMPLE of text returned in the search:
50102:{0x10C} [AUDIT] user.a@email.net - User activated on the server 1234
host=servername sourcetype=APP1 source=F:\Program Files (x86)\APP1\log0001.txt

I know this is simple, I just can't find the correct information on it.

Tags (3)
0 Karma
1 Solution

mw
Splunk Employee
Splunk Employee

If you want to use an Event Listing to just list out the raw events, you shouldn't have the "| table" stuff. Just use the search that shows properly in the flashtimeline and set the element to Event Listing.

View solution in original post

mw
Splunk Employee
Splunk Employee

If you want to use an Event Listing to just list out the raw events, you shouldn't have the "| table" stuff. Just use the search that shows properly in the flashtimeline and set the element to Event Listing.

mw
Splunk Employee
Splunk Employee

Using table will put it in a table. If you just want the raw events, maybe trying using "... | rex mode=sed ..." to keep only what you want.

0 Karma

gekoner
Communicator

mw, I should have been more specific. The reason I was using |table was I wanted to parse the output to only display some of the line. I think the best thing to do is use a regex value in the search parameter.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...