splunk
jinja_formatter
Splunk Cloud
Overview
Details
In many cases, people format a user-readable content within
Splunk -- either because they need to send an e-mail, show
a text in a dashboard, or push the results to JIRA or other
ticketing tool.
But when they format the actual readable message, they have
to use a a very simple formatting techniques, making the
query look rather ugly and difficult to maintain.
With a template, it's possible to specify the resulting
text with placeholders, which will later on be properly
populated by the query results. And that's exactly
what jinja2format does.
Splunk -- either because they need to send an e-mail, show
a text in a dashboard, or push the results to JIRA or other
ticketing tool.
But when they format the actual readable message, they have
to use a a very simple formatting techniques, making the
query look rather ugly and difficult to maintain.
With a template, it's possible to specify the resulting
text with placeholders, which will later on be properly
populated by the query results. And that's exactly
what jinja2format does.
Description
The jinja2format command returns events with a one new field,
formatted_template, unless you specify an result option.
Example
The following example will output the rendered template into
formatted_template field:
| makeresults count=1
| eval celsius = random()%100
| eval name = "Joe"
| jinja2format "It's {{ celsius }} degrees, {{ name }}!"
In this example, we override the output field:
| makeresults count=1
| eval celsius = random()%100
| eval name = "Joe"
| eval template="It's {{ celsius }} degrees, {{ name }}!"
| jinja2format result=out template
Templating Language
Please refer to the official documentation for more details.
Release Notes
Version 1.0.2
March 22, 2023
Less restrictive permissions, as it might have been causing problems in some installations.
Version 1.0.1
March 16, 2023