How apply SEDCMD after TRANSFORMS?

Jakub — Wed, 22 Sep 2021 16:00:31 GMT

Hello All,

My issue is:

We are receiving files from Source1, where are more types of logs. We want to split them and send them into another indexes. Issue is that there are no some unique fields in the logs, so its difficult to create REGEX in transform.conf.

Sep 21 08:48:29 10.128.38.16 2021-09-21 06:48:28.7004|INFO|Robot|21.09.2021 08:46:21|21.09.2021 08:48:28|AttendedBot|OK|Account: ....

Hence we have decided to put FLAG there. -- "Y@9?"

Sep 21 08:48:29 10.128.38.16 2021-09-21 06:48:28.7004|INFO|Y@9?|Robot|21.09.2021 08:46:21|21.09.2021 08:48:28|AttendedBot|OK|Account: ....

And now I would like to trigger this flag in transform.conf (lets say send it to new index) and after that remove it by SEDCMD. Everything works fine, SEDCMD and transforms.conf when they are not configured at the same time, but when they are, the SEDMCD is applied first so transfrom.conf has nothing to trigger.

Question is:

Is there possibility to apply transform.conf before SEDCMD?

Thank you very much.

Re: How apply SEDCMD after TRANSFORMS?

richgalloway — Wed, 22 Sep 2021 16:56:16 GMT

The precedence order is fixed. See https://community.splunk.com/t5/Getting-Data-In/Is-there-any-way-to-execute-SEDCMD-after-transforms-are-applied/m-p/218670

topic How apply SEDCMD after TRANSFORMS? in Getting Data In

How apply SEDCMD after TRANSFORMS?

Re: How apply SEDCMD after TRANSFORMS?