Splunk Search

Adding fields to the output of a CLI search

dmalcor
Engager

In the GUI I get results plus the fields: host, source, and sourcetype
Same search in the CLI I just get results, no fields (even when I ask for "fields":

# splunk search "reboot | fields + source, sourcetype, host"

I'm still very new to this, so I could be missing something really basic.

:-Dan

Tags (1)
0 Karma

dmalcor
Engager

The "table" command gave me the other half. Now I can get the host, source, and sourcetype, but I'm missing the actual search results. I tried adding "_raw", but that just gets me the results (same as before):

# splunk search "reboot | table host, source, _raw"
0 Karma

somesoni2
SplunkTrust
SplunkTrust

The field picker and the fields index/source/sourcetype is a Splunk GUI feature (provides metadata about the search result) and is not available in Splunk CLI (understandably). If you wish to see these fields into your result, you would have to use search commands like table.

e.g.

# splunk search " your search | table source, sourcetype, host, your other fields from search result"

dmalcor
Engager

It seem like we can't get the message and the details on the same line. The "" is no different than no "".

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this.

splunk search "reboot| table host, source , *"

This will give all the columns you need. I don't think you would be able to see the event listing (way to see in GUI) + these three additional columns. If you are interested in specific column, specify them in the table command.

0 Karma

dmalcor
Engager

The "table" command gave me the other half. Now I can get the host, source, and sourcetype, but I'm missing the actual search results. I tried adding "_raw", but that just gets me the results (same as before):

# splunk search "reboot | table host, source, _raw"
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...