Splunk Search

How to create raw field?


Hello everyone,

I have next one task: I want to collect (with collect command) information which I got after stats. Problem is that there is empty _raw field, and I don't want to add _raw in stats (because of heavy search)

So, now I have such search:


| stats ...
| table ...
| collect index=test


I need the _raw field before collect to apply to it rex sed command. 

I know that collect creates raw field even if it doesn't exist. If there are any other ways to create it? Thank you.

Labels (2)
0 Karma

Esteemed Legend

Hi @bosseres,

usually _raw isn't a field stored with collect command.

But if you have, in the collect fields, information do exactly define the _raw event (or events), you could create (in dashboard) a drilldows feature to display (from the index) only the _raw events interested to a selected raw in stats.

this is the approach used in ES where you have Correlation Searches that contain only the data relevant for the alert, then for each of them you can define a drilldown search that takes raw data from the index related to an alert using the information in the Correlation Search.



Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...