https://community.splunk.com/t5/Splunk-Search/how-to-extract-the-required-data-from-the-raw-field-in-splunk/m-p/557289#M158285 <LI-CODE lang="markup">| eval keep=_raw | rex mode=sed "s/.*Dns rule/Dns rule/g"</LI-CODE> Sun, 27 Jun 2021 10:49:52 GMT ITWhisperer 2021-06-27T10:49:52Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-the-required-data-from-the-raw-field-in-splunk/m-p/557256#M158264 <P>This is my _raw data consists</P><P><SPAN>06/24/2021 17:26:17 +0530, info_search_time=1624535777.471, Dns Rule=Passed, HOSTNAME=Passed, username=Passed, ssh Timeout rule=Passed, Node Name="IND-JLN-DIV-COR-SW-02", snmp rule=Passed, udld Rule=Passed, Enable Password=Passed, Snmp config rule=Passed, Line Vty 0 4 Timeout &amp; acl=Passed, Line Con 0 timeout=Passed, Service Policy=Passed, Https Rule=Passed, Line Con 0=Passed, Line aux 0=Passed, Node Ip Address="3.205.208.35", Don't Username=Passed, Service Password Encryption=Passed, Aaa Server-GE=Passed, Line Vty 5 15=Passed, Image Verification=Passed, Bootp Server=Passed, Config Title="4/26/2021 01:02 PM - Running", Line Vty 0 4=Passed, Logging Rule=Passed, Banner Rule=Passed, Config Type=Running, Finger Rule=Passed, Http Server=Passed, Name Server=Passed, Pad Service=Passed, System Boot=Passed, Telnet Rule=Passed, Trap Source=Passed, NTP Rule- GE=Passed, ftp service=Passed, ssh version=Passed, Source Route=Passed, Http Access Class=Passed</SPAN></P><P>&nbsp;</P><P><SPAN>I need some of the fields to be extracted from that data<BR /><BR />Dns Rule=Passed, HOSTNAME=Passed, username=Passed, ssh Timeout rule=Passed, Node Name="IND-JLN-DIV-COR-SW-02.genpact.com", snmp rule=Passed, udld Rule=Passed, Enable Password=Passed, Snmp config rule=Passed, Line Vty 0 4 Timeout &amp; acl=Passed, Line Con 0 timeout=Passed, Service Policy=Passed, Https Rule=Passed, Line Con 0=Passed, Line aux 0=Passed, Node Ip Address="3.205.208.35", Don't Username=Passed, Service Password Encryption=Passed, Aaa Server-GE=Passed, Line Vty 5 15=Passed, Image Verification=Passed, Bootp Server=Passed,<BR /><BR /><BR /><BR />please help with the solution.<BR />it would be appriciated</SPAN></P> Sat, 26 Jun 2021 10:21:10 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-the-required-data-from-the-raw-field-in-splunk/m-p/557256#M158264 vinod743374 2021-06-26T10:21:10Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-the-required-data-from-the-raw-field-in-splunk/m-p/557262#M158265 <LI-CODE lang="markup">| extract pairdelim="," kvdelim="="</LI-CODE> Sat, 26 Jun 2021 14:18:50 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-the-required-data-from-the-raw-field-in-splunk/m-p/557262#M158265 ITWhisperer 2021-06-26T14:18:50Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-the-required-data-from-the-raw-field-in-splunk/m-p/557282#M158278 <P>Thanks for the response, but i need that fields to be like a _raw only. not like a table.<BR /><BR /></P> Sun, 27 Jun 2021 09:18:56 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-the-required-data-from-the-raw-field-in-splunk/m-p/557282#M158278 vinod743374 2021-06-27T09:18:56Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-the-required-data-from-the-raw-field-in-splunk/m-p/557283#M158279 <P>i want to extract some of the raw data&nbsp; from _raw ,that are not useful for me.&nbsp;<BR /><BR /></P> Sun, 27 Jun 2021 09:22:40 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-the-required-data-from-the-raw-field-in-splunk/m-p/557283#M158279 vinod743374 2021-06-27T09:22:40Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-the-required-data-from-the-raw-field-in-splunk/m-p/557284#M158280 <P>Which fields do you want or not want? For example, if you didn't want everything before "Dns rule" you could do this</P><LI-CODE lang="markup">| rex mode=sed "s/.*Dns rule/Dns rule/g"</LI-CODE> Sun, 27 Jun 2021 09:39:52 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-the-required-data-from-the-raw-field-in-splunk/m-p/557284#M158280 ITWhisperer 2021-06-27T09:39:52Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-the-required-data-from-the-raw-field-in-splunk/m-p/557286#M158282 <P>Thankyou, it is working ,&nbsp; is there any possibility to save this filtered data to a new field,&nbsp;<BR />or is there any possibility to keep that&nbsp; original data also ??</P> Sun, 27 Jun 2021 10:30:11 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-the-required-data-from-the-raw-field-in-splunk/m-p/557286#M158282 vinod743374 2021-06-27T10:30:11Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-the-required-data-from-the-raw-field-in-splunk/m-p/557287#M158283 <P>thank you ,<BR />it is working, is there any way to save that filtered _raw data to a new field ,&nbsp; is there any possibility to keep the original data also , can you give me any solution for this.&nbsp;</P> Sun, 27 Jun 2021 10:37:51 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-the-required-data-from-the-raw-field-in-splunk/m-p/557287#M158283 vinod743374 2021-06-27T10:37:51Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-the-required-data-from-the-raw-field-in-splunk/m-p/557289#M158285 <LI-CODE lang="markup">| eval keep=_raw | rex mode=sed "s/.*Dns rule/Dns rule/g"</LI-CODE> Sun, 27 Jun 2021 10:49:52 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-the-required-data-from-the-raw-field-in-splunk/m-p/557289#M158285 ITWhisperer 2021-06-27T10:49:52Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-the-required-data-from-the-raw-field-in-splunk/m-p/557290#M158286 <P>Thank you so much .</P> Sun, 27 Jun 2021 10:53:41 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-the-required-data-from-the-raw-field-in-splunk/m-p/557290#M158286 vinod743374 2021-06-27T10:53:41Z