topic _rawdata in Splunk Search

_rawdata

guru333 — Mon, 15 Jul 2024 17:33:17 GMT

Hi,

I had been using search syntax "rename "_raw" AS errortrace" in my custom search but one of my app team needs _raw data to extract some header info.

How can i still pass _raw filed data still with renamin syntax still in place

Thanks

richgalloway — Mon, 15 Jul 2024 17:55:40 GMT

Once a field is renamed the original name no longer exists and cannot be referenced. All subsequent uses of the field must use the new name.

PickleRick — Mon, 15 Jul 2024 17:57:27 GMT

But you can use field alias.

guru333 — Tue, 16 Jul 2024 12:02:25 GMT

Tried to use "_raw =errortrace" in fields alias section...it did not pick up this field alias.