如何删除“|” 从 json 在 splunk 中导出？

Question

So I am trying to export through python splunk queries to elasticsearch. I am using the json.dump() feature in python which is working and converting exactly like SPLUNK Web's convert feature. My issue with it though is that it's giving me one field, named _RAW, with pipes '|' information so elastic search doesn't see the individual fields yet clumps it all together like so:

Data| nameId="123123" | exampleID='1234123' | fieldName="Example" ....etc

I want to be able to have a "data" field or a "fieldName" field not all of that clumped into one big field named "raw"

Answer 1

To remove the _raw field, you can use | fields - _raw | fields - _raw at the end of your search.

You may need to post your code if that doesn't help, as we may need more context

Answer 2

I got what I needed from appending | Fields *| Fields * to the end of my query. I was running a python script that queried splunk but it was running in fast mode not verbose, so the fields that I needed where in a _raw format and not individually displayed like in verbose.