I'm not sure I fully understand what you mean when you describe the event has having no "meaningful" _raw, but which has fields. That would imply that the _raw has been redacted during ingestion but fields have perhaps then been indexed, perhaps using INGEST EVAL. I was going to suggest using TERM(my_term) to search for terms you want, i.e. index=bla TERM(term) but that's effectively searching _raw which you say you don't have. Do you know how this data is being ingested? If someone has done some optimisation to remove _raw in the process of ingestion and you need it back, perhaps you need to discuss with your admins. Otherwise, if there is no _raw, you can't easily search for terms efficiently anywhere. You could do index=bla
``` Loop through every field doing a per field match against search_regex ```
| foreach * [ eval match=max(match, if(match('<<FIELD>>', "search_regex"), 1, 0)) ]
| where match=1 but this, like using fieldsummary, will be pretty inefficient, as you're getting all events from the index and then filtering. If your set of fields is static, you could create a macro, e.g. `search_all_fields(term)` and then in the macro expand out the field list so you have field1=$term$ OR field2=$term$ OR field3=$term$... and if you do actually have indexed fields, you could use the index field notation as field1::$term$ If you do index=bla on its own, what do you see? Can you look at the source for that - i.e. don't use table just look at the events and in the Event Actions dropdown for the event, select show source.
... View more
