We have updated our Terms of Service, Code of Conduct, and Addendum.

Am I able to search for the key value pairs found under _raw in a query?

Options
Justin Hamblin
Justin Hamblin Posts: 7
edited September 2023 in General Discussions

Hello. Quick Cribl Search question… Am I able to search for the key value pairs found under _raw in a query? I'm attempting to use it for Cloudtrail and here's an example of the structure.

Tagged:

Best Answer

Answers

  • Brandon McCombs
    Options

    not without using a regex (or a JS `.includes()` function because _raw is just a string in that screenshot, denoted by the alpha symbol to the left of it.

  • Brandon McCombs
    Options

    we're showing a user-friendly representation of it but it's not actually structured like inside _raw.

  • Justin Hamblin
    Options

    Ok. So just searching for various combinations of strings would be ok too?

  • Brandon McCombs
    Options

    yeah, unless you do something to parse that data so it's structured. Hard to tell if it can be parsed w/o seeing all of it

  • Justin Hamblin
    Options

    alright thank you!

  • dritan
    dritan Posts: 51 ✭✭
    edited September 2023
    Options

    do you see `awsRegion` extracted as a field?

    i.e., outside of _raw?

    if yes, then you should be able to reference `awsRegion=foobar` in Search without a problem.

  • Justin Hamblin
    Options

    no I don't all the data i'd want to specify is in _raw. I suppose I could turn region into a variable in the bucket path if i wanted to get more granular with searches

  • dritan
    dritan Posts: 51 ✭✭
    edited September 2023
    Options

    Yeah, can totally do that.

  • Justin Hamblin
    Justin Hamblin Posts: 7
    Answer ✓
    Options

    yup, sounds like a use-case for the `extract` operator

  • Brandon McCombs
    Options

    Agh , didn't even notice the question was about Search. I thought I saw Stream mentioned.