Splunk Search

Hide _raw instead of using a sed expression to trim _raw?

Bleepie
Communicator

Dear Splunk community,

I am using rex to extract data from _raw and put it into new fields like so:

 

 

[10/5/21 23:02:25:134 CEST] 00000063 SystemOut     O 05 Oct 2021 23:02:25:133 [INFO] [CRONSERVER] [CID-MXSCRIPT-1673979] SCRIPTNAME - 00 - Function:httpDiscovery(POST, https, host, /call, BASE64ENC(USER:PASSWORD)) Profile = MYPROFILE - Scope = MYHOSTNAME - End - Result(strResponseStatus, stResponseReason, strResponseData)=([200], [OK], [{"message":"SUCCESS"}{"runId":"2021100523022485"}
])
| rex field=_raw "Scope = (?<fqdn>\S*)"
| rex field=_raw "Profile = (?<profile>\S*)"

 

 

This will create new fields and also show _raw. I don't want _raw to show, but if I use this:

 

 

| table _time

 

 

Instead of this:

 

 

| table _time, _raw,

 

 

The fields that I create will no longer show, so I have to include _raw aswell. I can use mode=sed when using rex to delete data from _raw and for example only keep profile and then rename _raw to profile, but I don't have any experience using sed and I would prefer a easier way.

My question:

Is it possible to hide _raw and still use rex on _raw to create new fields?

 

Thanks.

 

Labels (3)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

It all depends on the order of your commands.

<search> | rex | table

Is a different beast from

<search> | table | rex

So I'd extract the fields first then either do a table over your fields

<search> | rex for field1 | rex for field2 | ... | table _time field1 field2 ...

Or instead of table you might just remove a _raw field

| fields - _raw

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

It all depends on the order of your commands.

<search> | rex | table

Is a different beast from

<search> | table | rex

So I'd extract the fields first then either do a table over your fields

<search> | rex for field1 | rex for field2 | ... | table _time field1 field2 ...

Or instead of table you might just remove a _raw field

| fields - _raw
0 Karma

Bleepie
Communicator

This never came up in my mind, thanks!


I used

fields - _raw

 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...