Splunk Search

How do I format Search Processing Language to align the pipes on the left side of the search bar?

Kyle_Jackson
Explorer

How do I format Search Processing Language (SPL) to align the pipes on the left side of the search bar (v 6.5.0)?

hard to read
index=_internal | eval ..... | convert ... | stats... | table ... | sort ...
vs
pretty print


index=_internal
| eval .....
| convert ...
| stats...
| table ...
| sort ...

0 Karma
1 Solution

cmerriman
Super Champion

cmerriman
Super Champion

http://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Parsingsearches#Search_bar_shortcuts

On Linux or Windows use Ctrl + \
On Mac OSX use Command + \

gcusello
SplunkTrust
SplunkTrust

probably you are meaning

index=_internal 
| eval ..... 
| convert ... 
| stats... 
| table ... 
| sort ...

Every way in 6.5 version there is an indentation of all source's tags with the only exception of searches.
If you want to indent also searches (I usually do it!) you have to manually do it.
Fortunately from 6.5 indentation remains also if I enter in Panels search modify, instead in the previous version if you do this you lose indentation.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...