topic Re: Trim off a trailing comma before the end of an event, SEDCMD? in Getting Data In

Trim off a trailing comma before the end of an event, SEDCMD?

evan_scheessele — Sat, 30 Mar 2013 00:13:58 GMT

I have a set of events, each a JSON object, separated from each other as one-per-line (SHOULD_LINEMERGE = false), but each of the JSON objects ends its line of text with a trailing comma:

...}},

How do I use a SEDCMD to trim off that comma? Just this?

SEDCMD-remove-trailing-json-comma = s/,$/

...or do I need to match the line-feed at the end of each event too?

NOTE: I'm assuming I should put this SEDCMD into my props.conf on my Splunk heavy-forwarder, one-hop upstream from my core-indexer. Any advice is welcome. The above SEDCMD doesn't seem to work.

From the logs:

splunkd.log.2:03-30-2013 00:02:07.330 +0000 ERROR regexExtractionProcessor - Error while parsing sed name="SEDCMD-remove-trailing-json-comma", string="s/,$/", errMsg="Failed to initialize sed. Failed to parse the replacement string."

Re: Trim off a trailing comma before the end of an event, SEDCMD?

ShaneNewman — Sat, 30 Mar 2013 01:37:02 GMT

Try SEDCMD-remove-trailing-json-comma = s/\,$//

Re: Trim off a trailing comma before the end of an event, SEDCMD?

dwaddle — Sat, 30 Mar 2013 02:36:13 GMT

I updated your syntax slightly. SEDCMD (like its sed great-grandfather) looks for a "find" and a "replace" which are (by convention) separated by the / character. So, to remove a trailing comma, you need to have the "replace" be an empty string.

Re: Trim off a trailing comma before the end of an event, SEDCMD?

evan_scheessele — Mon, 01 Apr 2013 16:03:42 GMT

Thanks - this ended up working for me, very similar. Yeah, I missed that final /

SEDCMD-remove-trailing-json-comma = s/,$//