Using specific fields

If you know the names of the fields you want to display in your output, your template can be fairly simple. Let's look at the template_example event type. The template is stored in appserver/event_renderers/template_example.html:

<%page args="job, event, request, options"> <ul class="template_example"> <li> <b>time:</b> ${i18n.format_datetime_microseconds(event.get('_time', event. time))} </li> <li> <b>ip:</b> ${event.get('ip', '')} </li> <li> <b>logger:</b> ${event.get('logger', '')} </li> <li> <b>message:</b> ${event.get('message', '')} </li> <li> <b>req_time:</b> ${event.get('req_time', '')} </li> <li> <b>session_id:</b> ${event.get('session_id', '')} </li> <li> <b>user:</b> ${event.get('user', '')} </li> <li> <b>_raw:</b> ...

Get Implementing Splunk 7 - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.