Hello. Quick Cribl Search question… Am I able to search for the key value pairs found under _raw in a query? I'm attempting to use it for Cloudtrail and here's an example of the structure.
yup, sounds like a use-case for the `extract` operator
not without using a regex (or a JS `.includes()` function because _raw is just a string in that screenshot, denoted by the alpha symbol to the left of it.
we're showing a user-friendly representation of it but it's not actually structured like inside _raw.
Ok. So just searching for various combinations of strings would be ok too?
yeah, unless you do something to parse that data so it's structured. Hard to tell if it can be parsed w/o seeing all of it
alright thank you!
do you see `awsRegion` extracted as a field?
i.e., outside of _raw?
if yes, then you should be able to reference `awsRegion=foobar` in Search without a problem.
no I don't all the data i'd want to specify is in _raw. I suppose I could turn region into a variable in the bucket path if i wanted to get more granular with searches
Yeah, can totally do that.
Agh , didn't even notice the question was about Search. I thought I saw Stream mentioned.