topic Re: regex: replace my events with _raw=Body in Splunk Search

regex: replace my events with _raw=Body

Mohsin123 — Wed, 14 Mar 2018 10:38:36 GMT

Hi,

I want to replace my events with _raw=Body
can anyone help ? pl let me know the regex .

Regards
Shraddha

Re: regex: replace my events with _raw=Body

493669 — Wed, 14 Mar 2018 10:41:57 GMT

can you provide sample events and what is expected output?

Re: regex: replace my events with _raw=Body

493669 — Wed, 14 Mar 2018 11:58:37 GMT

it seems previous comments are deleted :
have you tried:

...|rex "\nBody:\s(?<_raw>[^\}]+)"

Re: regex: replace my events with _raw=Body

Mohsin123 — Thu, 15 Mar 2018 06:52:33 GMT

I asked you how we can rewrite event at HF level, so that data come only having Body data.

You are giving me query I gave you 😄

Re: regex: replace my events with _raw=Body

p_gurav — Thu, 15 Mar 2018 07:00:25 GMT

You can use route and filter on HF. Refer below data:
http://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Routeandfilterdatad

If you want to Anonymize you can use SED-CMD
https://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Anonymizedata

Re: regex: replace my events with _raw=Body

akocak — Tue, 29 Sep 2020 20:29:06 GMT

Assuming this is your regex for the field:

 ...|rex "\nBody:\s(?<_raw>[^\}]+)"

then I would do

....| regex field=_raw "\nBody:\s(?<new_raw>[^\}]+)"
| eval _raw=new_raw

please note that pre-extracted fields such as host, _time, sourcetype will still be there. you can always see time of the event even if it doesn't exist in new_raw.

If you want to index from HF on this way, this will require you props.conf and transforms.conf. But that's not the question after all 🙂

Re: regex: replace my events with _raw=Body

woodcock — Sun, 15 Jul 2018 14:33:08 GMT

Nobody is going to be able to answer your question or even give you much help unless you provide a great deal more detail, including samples of your existing data and a mockup of your desired final state.