Need to add _raw content into "Log Event"


My Splunk alerts use the "Log Event" actions. How do I add the contents of _raw into the "Event" field? I tried $result._raw$ but that doesn't appear to be working. Log Event

Having the result content would be really helpful in the Log Event.

0 Karma

Splunk Employee
Splunk Employee

not sure if you are looking something like " | eval rawevent=_raw"?

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!