topic Split _raw field in Getting Data In

Split _raw field

3amer92 — Tue, 05 May 2020 18:26:22 GMT

Hello there,

I'm new to Splunk, and I have setup an alert to that returns some field including _raw field.
The thing is that _raw field is to big, I'm wondering if there is a way to return maybe the top two or three rows of it.

Re: Split _raw field

richgalloway — Wed, 30 Sep 2020 05:13:03 GMT

It's not usual to display _raw. Usually, you'll display fields that were extracted from it, instead.
To display part of a field, use substr. For example, ... | eval _raw = substr(_raw, 1, 100) to see the first 100 characters of _raw.