There are a few Splunk keyboard shortcuts that every Splunk power user should know. Two of the tips here allow you to quickly reformat search and dashboard code while the other expands macros.

Windows users should substitute CTRL for CMD in the examples below.

Quickly Reformat Your Splunk Searches

Did you know there is a shortcut key that can quickly reformat your Splunk searches?

Splunk search before using the reformat keyboard shortcut
Badly formatted Splunk Search

Hit “CMD \” and your search will be nicely formatted!

Splunk search after using the reformat keyboard shortcut
Well formatted Splunk Search

Expand Macros

If you need to quickly see what a macro does you can use the “CMD SHIFT E” keyboard shortcut.

Expanding a macro using the Splunk Keyboard Shortcut
Macro expansion using CMD SHIFT E

Formatting SimpleXML

As you copy, paste and edit sections of a SimpleXML dashboard it is easy for the formatting to go off. To quickly reformat the SimpleXML you can use the “CMD SHIFT F” keyboard shortcut. The screenshots below show before and after.

Before and after screenshots showing how the Format SimpleXML Splunk Keyboard Shortcut can help.
SimpleXML reformatted with CMD SHIFT F

Further Tips

Write splunk searches like a pro and include comments – check this article to see how.

For 2021 we’ve committed to posting a new Splunk tip every week!

If you want to keep up to date on tips like the one above then sign up below:

Subscribe to our newsletter to receive regular updates from iDelta, including news and updates, information on upcoming events, and Splunk tips and tricks from our team of experts. You can also find us on Twitter and LinkedIn.

Subscribe

* indicates required
Posted by:Stuart Robertson

Stuart Robertson is the Consulting Director at iDelta. He is one of the initial founders of iDelta and has worked there since formation in 2001. Stuart holds various certifications in Core Splunk and ITSI. Stuart also holds a Bsc(Hons) in Computing Science from the University of Glasgow.