From 99604f5baedf8cf1ecf5dca1738abeb4bf958d71 Mon Sep 17 00:00:00 2001
From: Parv Desai <pdesai@splunk.com>
Date: Wed, 30 Nov 2022 11:38:25 +0530
Subject: [PATCH] minor fix

---
 splunk_connector.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/splunk_connector.py b/splunk_connector.py
index 4fc2bd5..6e04636 100644
--- a/splunk_connector.py
+++ b/splunk_connector.py
@@ -1333,7 +1333,7 @@ def _run_query(self, search_query, action_result, attach_result=False, kwargs_cr
             if not isinstance(result, dict):
                 continue
 
-            if not add_raw_field:
+            if not add_raw_field and result.get("_raw"):
                 del result["_raw"]
 
             action_result.add_data(result)