Hello there,
I'm new to Splunk, and I have setup an alert to that returns some field including _raw field.
The thing is that _raw field is to big, I'm wondering if there is a way to return maybe the top two or three rows of it.
It's not usual to display _raw. Usually, you'll display fields that were extracted from it, instead.
To display part of a field, use substr
. For example, ... | eval _raw = substr(_raw, 1, 100)
to see the first 100 characters of _raw.