outputtext
Description
Outputs the contents of the _raw
field to the _xml
field.
The outputtext
command was created as an internal mechanism to render event texts for output.
Syntax
outputtext [usexml=<bool>]
Optional arguments
- usexml
- Syntax: usexml=<bool>
- Description: If set to true, the copy of the
_raw
field in the_xml
is escaped XML. Ifusexml
is set to false, the_xml
field is an exact copy of_raw
. - Default: true
Usage
The outputtext
command is a reporting command.
The outputtext
command writes all search results to the search head. In Splunk Web, the results appear in the Statistics tab.
Examples
1. Output the _raw field into escaped XML
Output the "_raw" field of your current search into "_xml".
... | outputtext
See also
outputlookup | overlap |
This documentation applies to the following versions of Splunk Cloud Platform™: 8.2.2112, 8.2.2201, 8.2.2202, 8.2.2203, 9.0.2205, 9.0.2208, 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308, 9.1.2312, 9.2.2403 (latest FedRAMP release), 9.2.2406
Feedback submitted, thanks!