Split _raw field

[3amer92]

Hello there,

I'm new to Splunk, and I have setup an alert to that returns some field including _raw field.
The thing is that _raw field is to big, I'm wondering if there is a way to return maybe the top two or three rows of it.

[richgalloway]

It's not usual to display _raw. Usually, you'll display fields that were extracted from it, instead.
To display part of a field, use substr. For example, ... | eval _raw = substr(_raw, 1, 100) to see the first 100 characters of _raw.