Auto-format search syntax

As you build a search, you can set up the Splunk software to format the search syntax as you type. Auto-format makes your searches more readable. Each pipe section is parsed onto a separate line. Any subsearches are indented.

The following image shows how a search appears in the Search bar when auto-format is turned off.

This screen image shows a search in the Search bar.

When auto-format is turned on, this same search is parsed as shown in the following image.

This screen image shows the same search with each piped section on a new line in the Search bar.

Characters that trigger auto-format

Character Automatic formatting
Pipe ( | ) The pipe is placed on a new line to separate each new piped section of your search criteria.
Left square bracket ( [ ) The left square bracket, which signifies the start of a subsearch, is placed on a new line and indented several spaces.
Note: If the pipe or left bracket is inside a quoted string, the auto-format is not triggered.

Turn on Search auto-format

By default, automatic formatting of search syntax is turned off. You can turn on the automatic formatting of the search syntax in the Preferences dialog box.

Changing the options in the Preferences dialog box changes the setting only for you. It does not impact the setting for other users.

  1. On the Splunk bar, select [User_account_name] > Preferences.
  2. Click SPL Editor.
  3. Confirm that Advanced editor is turned on.
  4. On the General tab, click Search auto-format.

    This screen image shows the Preferences window with the SPL Editor preferences selected. The toggle switches for "Advanced editor" and "Search auto-format" are both in the on position.

  5. Click Apply.

Auto-formatting is applied to new searches that you type into the Search bar. If you already have a search in the Search bar, use the Search bar shortcuts to apply auto-formatting to that search.

Why are my searches not auto-formatting?

The auto-format feature works on searches that you type into the Search bar. If you paste a search into the Search bar or select a search from Search History, the search is not automatically formatted even when the auto-format feature is turned on.

To apply auto-formatting to a search that you paste into the Search bar or select from Search History, use the following keyboard shortcut to apply auto-formatting to that search.

  • On Linux or Windows use Ctrl + \
  • On Mac OSX use Command + \