Splunk Search

using dc, showing _raw field

tedder
Communicator

This should be easy. I'm building a query:

index=asdf "search string" | rex field=_raw mode=sed "s/.*foo(.*?)bar/\1/"

Great. Now it returns a portion of the log that I want to see. I need to "count and group" that now.

index=asdf "search string" | rex field=_raw mode=sed "s/.*foo(.*?)bar/\1/" | stats count by _raw

Hmm. That just returns raw counts, but not the data. Forcing it causes nothing to return:

index=asdf "search string" | rex field=_raw mode=sed "s/.*foo(.*?)bar/\1/" | stats count by _raw as dcount | fields _raw

So, given the first query, can someone add "count and group, sort by top counts" to it? Yes, I know this can theoretically be a field extraction, but I don't want that in this case.

Tags (1)
1 Solution

ziegfried
Influencer

The _raw field isn't displayed in the results, because it begins with an underscore. You have to rename it in order to be displayed in the result:

index=asdf "search string" | rex field=_raw mode=sed "s/.*foo(.*?)bar/\1/" | rename _raw as raw | stats count by raw

View solution in original post

ziegfried
Influencer

The _raw field isn't displayed in the results, because it begins with an underscore. You have to rename it in order to be displayed in the result:

index=asdf "search string" | rex field=_raw mode=sed "s/.*foo(.*?)bar/\1/" | rename _raw as raw | stats count by raw

tedder
Communicator

exactly what I needed. Thanks.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...