Splunk Enterprise Security

Raw data on Enterprise Security

New Member

Hello guys! Does anyone know  how I can get (raw data | raw log) from a dataset on Enterprise Security?

On Splunk Enterprise I usually use (| eval Log=_raw) and when I try to do the same on ES, I get empty response.

Thanks in advance for any help. 


Labels (2)
0 Karma


By desfault, Splunk extracted field automatically,

You can use regex to extract data from Raw data:

| eval Log=_raw <your_regex>

or if you are not aware of regex you can select any row and extract from splunk UI. refer below imageCapture.PNG

0 Karma

New Member

Yes, you're right.

But for some reason I'm not receiving anything.

I define logMessage like below:


Then I use | table command and don't get anything.


Again, I don't know if Enterprise is different from Enterprise Security at this point.

Thanks again.

0 Karma

| rex field=_raw

use this... after _raw you need to add some regex:



0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...