Splunk Enterprise Security

Raw data on Enterprise Security

stealth_eth0
New Member

Hello guys! Does anyone know  how I can get (raw data | raw log) from a dataset on Enterprise Security?

On Splunk Enterprise I usually use (| eval Log=_raw) and when I try to do the same on ES, I get empty response.

Thanks in advance for any help. 

Cheers!

Labels (2)
0 Karma

dhirendra761
Contributor

By desfault, Splunk extracted field automatically,

You can use regex to extract data from Raw data:

| eval Log=_raw <your_regex>

or if you are not aware of regex you can select any row and extract from splunk UI. refer below imageCapture.PNG

0 Karma

stealth_eth0
New Member

Yes, you're right.

But for some reason I'm not receiving anything.

I define logMessage like below:

stealth_eth0_0-1621456140479.png

Then I use | table command and don't get anything.

stealth_eth0_1-1621456160855.png

Again, I don't know if Enterprise is different from Enterprise Security at this point.

Thanks again.

0 Karma

dhirendra761
Contributor
| rex field=_raw

use this... after _raw you need to add some regex:

 

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2104/SearchReference/Rex

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>