Outputs the contents of the
_raw field to the
outputtext command was created as an internal mechanism to render event texts for output.
- Syntax: usexml=<bool>
- Description: If set to true, the copy of the
_rawfield in the
_xmlis escaped XML. If
usexmlis set to false, the
_xmlfield is an exact copy of
- Default: true
outputtext command is a reporting command.
outputtext command writes all search results to the search head. In Splunk Web, the results appear in the Statistics tab.
1. Output the _raw field into escaped XML
Output the "_raw" field of your current search into "_xml".
... | outputtext
This documentation applies to the following versions of Splunk Cloud Platform™: 8.2.2106, 8.2.2107, 8.2.2111, 8.2.2112, 8.2.2109, 8.2.2201, 8.2.2202, 8.2.2203, 9.0.2205, 9.0.2208, 9.0.2209 (latest FedRAMP release)