Splunk Search

skip first 10 lines of search results

guru333
Engager

_raw=

line 1

line 2

line 3

line 4

line 5

line 6

how to define another new field "copyofraw"  to contain just line 5 and line 6

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Need a little more information about the real data and its format, but if you want to ignore the first 4 lines, which are terminated by a linefeed then get the rest of the data, see this example

| makeresults 
| fields - _time
| eval _raw="line 1
line 2
line 3
line 4
line 5
line 6"
| rex "(?ms)([^\n]*\n){4}(?<copyofraw>.*)"
0 Karma

guru333
Engager

I want to execute this skip first 7 lines on splunk default environment variable "_raw" and not on 

eval _raw="line 1
line 2
line 3
line 4
line 5
line 6"

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

The makeresults / eval is an example you can run to show you how this works - in your first post you said you wanted lines 5 and 6 - now you want to skip the first 7 lines and your post says you want to skip first 10 lines?

Confused...

Please give more precise information about your requirement

0 Karma

guru333
Engager

sorry for confusion.

I want to skip 1st 7 lines of environment variable "_raw" and then copy that info from 7th line  to new variable "_raw_refined"

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

So, use the rex statement I provided and change the 4 to a number of lines you want to skip and change copyofraw to the name of the field you want to create.

Note that _raw is a FIELD in Splunk, not an environment variable - Splunk has fields that are part of your data and _raw and _time are key fields

0 Karma

guru333
Engager

I need to skip 1st 10 lines of key field "_raw"

0 Karma

bowesmana
SplunkTrust
SplunkTrust

When you tried my suggestion, please tell me what happened and what still is not working.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...