Dear Splunk community,
I am using rex to extract data from _raw and put it into new fields like so:
[10/5/21 23:02:25:134 CEST] 00000063 SystemOut O 05 Oct 2021 23:02:25:133 [INFO] [CRONSERVER] [CID-MXSCRIPT-1673979] SCRIPTNAME - 00 - Function:httpDiscovery(POST, https, host, /call, BASE64ENC(USER:PASSWORD)) Profile = MYPROFILE - Scope = MYHOSTNAME - End - Result(strResponseStatus, stResponseReason, strResponseData)=([200], [OK], [{"message":"SUCCESS"}{"runId":"2021100523022485"}
])
| rex field=_raw "Scope = (?<fqdn>\S*)"
| rex field=_raw "Profile = (?<profile>\S*)"
This will create new fields and also show _raw. I don't want _raw to show, but if I use this:
| table _time
Instead of this:
| table _time, _raw,
The fields that I create will no longer show, so I have to include _raw aswell. I can use mode=sed when using rex to delete data from _raw and for example only keep profile and then rename _raw to profile, but I don't have any experience using sed and I would prefer a easier way.
My question:
Is it possible to hide _raw and still use rex on _raw to create new fields?
Thanks.
It all depends on the order of your commands.
<search> | rex | table
Is a different beast from
<search> | table | rex
So I'd extract the fields first then either do a table over your fields
<search> | rex for field1 | rex for field2 | ... | table _time field1 field2 ...
Or instead of table you might just remove a _raw field
| fields - _raw
It all depends on the order of your commands.
<search> | rex | table
Is a different beast from
<search> | table | rex
So I'd extract the fields first then either do a table over your fields
<search> | rex for field1 | rex for field2 | ... | table _time field1 field2 ...
Or instead of table you might just remove a _raw field
| fields - _raw