On the Splunk bar, select > Account Settings.You turn on line numbering in Search Preferences. Pressing Enter does not create a new line in the Search bar.īy default, line numbering is turned off. You press Shift + Enter to split the active row at the cursor.You use the Search bar shortcuts to auto-format the current search.The Search auto-formatting feature is turned on and you type a pipe character or left square bracket.You can create lines in the Search bar by using the following methods. You might have a long line that spans multiple rows in the Search bar, but is still only one line.įor example, if you paste a long search into the Search bar that has not already been formatted with multiple lines, the search has one line number and spans multiple rows. A row in the Search bar is not necessarily a line. The line numbering feature applies numbers only to lines. To make reading your searches easier, you can display line numbers in the Search bar. It does not impact the setting for other users. In the Search Preferences section under Search auto-format, select On.Ĭhanging the options in Search Preferences, changes the setting only for you.You can turn on the automatic formatting of the search syntax in Search Preferences. Turn on Search auto-formatīy default, automatic formatting of search syntax is turned off. If the pipe or left bracket is inside a quoted string, the auto-format is not triggered. The left square bracket, which signifies the start of a subsearch, is placed on a new line and indented several spaces. The pipe is placed on a new line to separate each new piped section of your search criteria. Ĭharacters that trigger auto-format Character On many non-English keyboards you can use Command + Shift + F. On many non-English keyboards you can use Ctrl + Shift + F. To apply auto-formatting to a search that you paste into the Search bar or select from Search History, use the keyboard shortcut to apply auto-formatting to that specific search. If you paste a search into the Search bar or select a search from Search History, the search is not automatically formatted even when the auto-format feature is turned on. The auto-format feature works on searches that you type into the Search bar. In the Search Preferences section under Syntax highlighting, select the color theme that you want to use.Īs you build a search, you can set up the Splunk software to format the search syntax as you type.Īuto-format works on searches that you type.Colors for commands, arguments, clauses, functions, keys (in a key-value pair), values, and comments. Colors for commands, arguments, clauses, functions, keys (in a key-value pair), values, and comments.īlack background. You can change the appearance of the criteria in the Search bar by specifying a color theme. In the Search Preferences section under Syntax highlighting, select Black on white.|top limit=false the term false is highlighted in red because it is not a integer. For example, the limit argument for the top command expects an integer. If you specify incorrect data type for an argument, the value turns red. The lack of color helps you ensure that the search is using the correct syntax. If command, argument, function, or boolean operator is not spelled or capitalized correctly the term is not highlighted in color. The color codes for the Light theme are described in the following table. The color coding that is used for the search syntax depends on the color theme that is implemented. The following image shows the syntax highlighting Light theme.īy default, syntax highlighting is turned on. With syntax highlighting turned on, the search is easier to read. Sourcetype=access_* | timechart count(eval(action=purchase)) BY productName usenull=false useother=false With syntax highlighting, the SPL commands, arguments, functions, and keywords are color-coded to make it easier to read a search. There are also keyboard shortcuts to help you find information in your searches. The syntax highlighting feature displays parts of SPL in different colors. The Search bar contains features to help you read, parse, or interpret the Splunk Search Processing Language (SPL) syntax.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |