Splunk Search

Adding fields to the output of a CLI search

dmalcor
Engager

In the GUI I get results plus the fields: host, source, and sourcetype
Same search in the CLI I just get results, no fields (even when I ask for "fields":

# splunk search "reboot | fields + source, sourcetype, host"

I'm still very new to this, so I could be missing something really basic.

:-Dan

Tags (1)
0 Karma

dmalcor
Engager

The "table" command gave me the other half. Now I can get the host, source, and sourcetype, but I'm missing the actual search results. I tried adding "_raw", but that just gets me the results (same as before):

# splunk search "reboot | table host, source, _raw"
0 Karma

somesoni2
Revered Legend

The field picker and the fields index/source/sourcetype is a Splunk GUI feature (provides metadata about the search result) and is not available in Splunk CLI (understandably). If you wish to see these fields into your result, you would have to use search commands like table.

e.g.

# splunk search " your search | table source, sourcetype, host, your other fields from search result"

dmalcor
Engager

It seem like we can't get the message and the details on the same line. The "" is no different than no "".

0 Karma

somesoni2
Revered Legend

Try this.

splunk search "reboot| table host, source , *"

This will give all the columns you need. I don't think you would be able to see the event listing (way to see in GUI) + these three additional columns. If you are interested in specific column, specify them in the table command.

0 Karma

dmalcor
Engager

The "table" command gave me the other half. Now I can get the host, source, and sourcetype, but I'm missing the actual search results. I tried adding "_raw", but that just gets me the results (same as before):

# splunk search "reboot | table host, source, _raw"
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...