Splunk Search

using dc, showing _raw field

tedder
Communicator

This should be easy. I'm building a query:

index=asdf "search string" | rex field=_raw mode=sed "s/.*foo(.*?)bar/\1/"

Great. Now it returns a portion of the log that I want to see. I need to "count and group" that now.

index=asdf "search string" | rex field=_raw mode=sed "s/.*foo(.*?)bar/\1/" | stats count by _raw

Hmm. That just returns raw counts, but not the data. Forcing it causes nothing to return:

index=asdf "search string" | rex field=_raw mode=sed "s/.*foo(.*?)bar/\1/" | stats count by _raw as dcount | fields _raw

So, given the first query, can someone add "count and group, sort by top counts" to it? Yes, I know this can theoretically be a field extraction, but I don't want that in this case.

Tags (1)
1 Solution

ziegfried
Influencer

The _raw field isn't displayed in the results, because it begins with an underscore. You have to rename it in order to be displayed in the result:

index=asdf "search string" | rex field=_raw mode=sed "s/.*foo(.*?)bar/\1/" | rename _raw as raw | stats count by raw

View solution in original post

ziegfried
Influencer

The _raw field isn't displayed in the results, because it begins with an underscore. You have to rename it in order to be displayed in the result:

index=asdf "search string" | rex field=_raw mode=sed "s/.*foo(.*?)bar/\1/" | rename _raw as raw | stats count by raw

tedder
Communicator

exactly what I needed. Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...