Outputs the contents of the
_raw field to the
outputtext command was created as an internal mechanism to render event texts for output.
- Syntax: usexml=<bool>
- Description: If set to true, the copy of the
_rawfield in the
_xmlis escaped XML. If
usexmlis set to false, the
_xmlfield is an exact copy of
- Default: true
outputtext command is a reporting command.
outputtext command writes all search results to the search head. In Splunk Web, the results appear in the Statistics tab.
1. Output the _raw field into escaped XML
Output the "_raw" field of your current search into "_xml".
... | outputtext
This documentation applies to the following versions of Splunk Cloud™: 7.0.13, 7.2.9, 7.2.10, 8.0.2006, 8.0.2007, 8.1.2008, 8.1.2009, 8.1.2011, 8.1.2012 (latest FedRAMP release), 8.1.2101, 8.1.2103, 8.2.2104, 8.2.2105