How do I pull out a substring from my _raw, and put it at the **beginning** of the event?

Question

Any suggestions for the best function to use if I need to pull out a substring (a key=value pair to be exact) from my _raw, and put it at the beginning of the event?
In summary, trying to go from:raw=,<my_KV_pair>, to:raw=<my_KV_pair>,

Jon Rust · Answer

Use the Mask function, make it three parts, the stuff before your target, the part youre targeting, everything after. If your _raw has multiple lines, be sure to check the ‘s flag.

Match: (first part)(middle part)(last part)
Replace: g3+g1+g2

How do I pull out a substring from my _raw, and put it at the beginning of the event?

1 reply

Sign up

Using your Cribl Curious or University Account

Login to the community

Using your Cribl Curious or University Account