Splunk Enterprise Security

Raw data on Enterprise Security

stealth_eth0
New Member

Hello guys! Does anyone know  how I can get (raw data | raw log) from a dataset on Enterprise Security?

On Splunk Enterprise I usually use (| eval Log=_raw) and when I try to do the same on ES, I get empty response.

Thanks in advance for any help. 

Cheers!

Labels (2)
0 Karma

dhirendra761
Contributor

By desfault, Splunk extracted field automatically,

You can use regex to extract data from Raw data:

| eval Log=_raw <your_regex>

or if you are not aware of regex you can select any row and extract from splunk UI. refer below imageCapture.PNG

0 Karma

stealth_eth0
New Member

Yes, you're right.

But for some reason I'm not receiving anything.

I define logMessage like below:

stealth_eth0_0-1621456140479.png

Then I use | table command and don't get anything.

stealth_eth0_1-1621456160855.png

Again, I don't know if Enterprise is different from Enterprise Security at this point.

Thanks again.

0 Karma

dhirendra761
Contributor
| rex field=_raw

use this... after _raw you need to add some regex:

 

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2104/SearchReference/Rex

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...