topic Re: does universalforwarder support SEDCMD? in Getting Data In

does universalforwarder support SEDCMD?

crazyeva — Wed, 22 Jan 2014 15:30:27 GMT

timeformat is not desired, I tried SEDCMD to correct it(12-hour format with 'am','pm')

props.conf of INDEXER:
SEDCMD-timechar=s/XXXXX/AM/g s/YYYYY/PM/g
TIME_FORMAT=%d-%m-%y %I.%M.%S.%9N %p

but '%p' is not recognized, as SEDCMD has not been effective in the same props.conf.

I wonder if i can put SEDCMD to UNIVERSALFORWARDER, and TIME_FORMART remain on INDEXER?

Re: does universalforwarder support SEDCMD?

gfuente — Wed, 22 Jan 2014 15:36:46 GMT

Hello

SEDCMD happens at the parsing stage, so it applies in a heavy forwarder or in a indexer.

Regards

Re: does universalforwarder support SEDCMD?

crazyeva — Wed, 22 Jan 2014 15:53:01 GMT

thank you!
do you have any idea to solve my problem:
timestamp form '22-1-14 09.30.00.000000000 \A\C' in which '\A\C' means PM

Re: does universalforwarder support SEDCMD?

gfuente — Wed, 22 Jan 2014 16:00:54 GMT

If your config is correct it should work on the indexer, or you can use a heavy forwarder too. Anyway try it locally in the indexer until it works, then move your configs into the production enviroment.

Re: does universalforwarder support SEDCMD?

crazyeva — Wed, 22 Jan 2014 16:41:49 GMT

'TIME_FORMAT=%d-%m-%y %I.%M.%S.%9N %p' is correct when i manully modified source data with AM/PM
and 'SEDCMD' part is also effective of replacing XXYY with AM/PM
But they do not work together.