Hide _raw instead of using a sed expression to trim _raw?

[Bleepie]

Dear Splunk community,

I am using rex to extract data from _raw and put it into new fields like so:

[10/5/21 23:02:25:134 CEST] 00000063 SystemOut     O 05 Oct 2021 23:02:25:133 [INFO] [CRONSERVER] [CID-MXSCRIPT-1673979] SCRIPTNAME - 00 - Function:httpDiscovery(POST, https, host, /call, BASE64ENC(USER:PASSWORD)) Profile = MYPROFILE - Scope = MYHOSTNAME - End - Result(strResponseStatus, stResponseReason, strResponseData)=([200], [OK], [{"message":"SUCCESS"}{"runId":"2021100523022485"}
])

| rex field=_raw "Scope = (?<fqdn>\S*)"
| rex field=_raw "Profile = (?<profile>\S*)"

This will create new fields and also show _raw. I don't want _raw to show, but if I use this:

| table _time

Instead of this:

| table _time, _raw,

The fields that I create will no longer show, so I have to include _raw aswell. I can use mode=sed when using rex to delete data from _raw and for example only keep profile and then rename _raw to profile, but I don't have any experience using sed and I would prefer a easier way.

My question:

Is it possible to hide _raw and still use rex on _raw to create new fields?

Thanks.

[PickleRick · Accepted solution]

It all depends on the order of your commands.

<search> | rex | table

Is a different beast from

<search> | table | rex

So I'd extract the fields first then either do a table over your fields

<search> | rex for field1 | rex for field2 | ... | table _time field1 field2 ...

Or instead of table you might just remove a _raw field

| fields - _raw

[Bleepie]

This never came up in my mind, thanks!


I used

fields - _raw