Need to add _raw content into "Log Event"

fshimaya · ‎08-01-2019

My Splunk alerts use the "Log Event" actions. How do I add the contents of _raw into the "Event" field? I tried $result._raw$ but that doesn't appear to be working.

Having the result content would be really helpful in the Log Event.

sgontla_splunk · ‎08-01-2019

not sure if you are looking something like " | eval rawevent=_raw"?

Need to add _raw content into "Log Event"

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you a member of the Splunk Community?

Need to add _raw content into "Log Event"

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...