Re: Need to add _raw content into "Log Event"

fshimaya · ‎08-01-2019

My Splunk alerts use the "Log Event" actions. How do I add the contents of _raw into the "Event" field? I tried $result._raw$ but that doesn't appear to be working.

Having the result content would be really helpful in the Log Event.

sgontla_splunk · ‎08-01-2019

not sure if you are looking something like " | eval rawevent=_raw"?

Need to add _raw content into "Log Event"

Splunk Observability for AI

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Splunk Observability as Code: From Zero to Dashboard

Are you a member of the Splunk Community?

Need to add _raw content into "Log Event"

Splunk Observability for AI

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Splunk Observability as Code: From Zero to Dashboard