Search Reference

outputtext

Description

Outputs the raw text (_raw) of results into the _xml field.

The outputtext command was created as an internal mechanism to render event texts for output.

By default, the command xml-escapes the text of events and copies them to the _xml field. If usexml=false, outputtext simply copies the text of events to the _xml field.

Since outputtext is a reporting command, the command will pull all events to the search head and cause the output to show in the statistics UI if used in the web interface.

Syntax

outputtext [usexml=<bool>]

Optional arguments

usexml

Syntax: usexml=<bool>

Description: If usexml is set to true (the default), the copy of the _raw field in _xml is xml escaped. If usexml is set to false, the _xml field is an exact copy of _raw.

Examples

Example 1:

Output the "_raw" field of your current search into "_xml".

... | outputtext

See also

outputcsv

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the outputtext command.