topic Re: Insert hex char in SEDCMD in Splunk Enterprise

Insert hex char in SEDCMD

biagiodipalma — Mon, 28 Jun 2021 08:42:49 GMT

Hi there,

I want to append a null frame char (x00) to my raw logs intercepted by props stanza. How can I solve this?

I tried to insert strings like:

SEDCMD
REGEX = (.*) followed by FORMAT

Any hints?

Re: Insert hex char in SEDCMD

kamlesh_vaghela — Mon, 28 Jun 2021 08:49:08 GMT

@biagiodipalma

Are you looking for this?

[YOUR_SOURCETYPE] SEDCMD-a=s/$/x00/g . . .

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Insert hex char in SEDCMD

biagiodipalma — Mon, 28 Jun 2021 15:02:10 GMT

This not worked for me, just for explaining: logs are intercepted by stanza in props and sent as syslogs. I need to insert \x00 at the end of each log in order to say to receiver that the log is over and to wait for another one. Now the receiver waits for other logs..