can i get the default _raw with out specificing it in the query ??

[rakesh_498115]

Hi..

I have search query which gives me a ouput of certain fields say A,B,C and we know that splunk has two default fields _raw and _time .i haven't given these two fields in my search query but i have used them in my html display module has $resuls[0]._raw$ etc..but there are not getting displayed ??

I dnt want my raw data to be displayed in the query resutls , but want it to be displayed upon the user click in my html module..

my search is some thing like this..

(my search ) | table A,B,C

now when i use $results[0].A$ in html module its working fine...but i want the _raw field to be displayed in the HTML module , with out showing it in the search command above .ie with the table command above..how can i do it ? is there any trick to do it in splunk ?? please help..

[tskinnerivsec]

Have you tried creating a macro of the search that includes the _raw field, that way you can just specify the macro in the search bar instead of using a search with the _raw field in it?

[rakesh_498115]

Thanks for your help 🙂

[tskinnerivsec]

In your macros.conf file for your app you could have something defined as simple as:

[firewall_traffic]
args =
definition = tag=firewall tag=communicate

Then in a saved search use it like this:

search = firewall_traffic | top 10 classification

So, in the application that you are writing, include a macros.conf file that defines a macro for the search with the _raw in it. Then, you can call the macro by name in your searches without calling the _raw field by name. I would reference the macros.conf example file, which I need to spend a little more time with myself.

[rakesh_498115]

can you pls give me a example for this ?