topic Re: Can i remove blank lines in my event ?? in Getting Data In

Can i remove blank lines in my event ??

rakesh_498115 — Fri, 15 Nov 2013 07:00:40 GMT

I have an so many blanklines , and whitespaces in a single event , Now i want to strip of these blank lines , and mutliple whitespaces ignoring a single whitespace. How can i do this using SEDCMD prop in props.conf

I have tried the following configuration,in props.conf

SEDCMD-parse1 = s/(?m)\n//g s/ *//g

s/(?m)\n//g - to remove blanklines
s/ *//g - to remove mutliple whitespaces

but this doesnt work ? any better idea of doing this pls ?

My sample event :

`
26-JUL-13:10-23-34

<sample

Text

</ Envelope >
`

Now i am expecting the following output,



26-JUL-13:10-23-34 Text

Sry i am unable to post sample event also, it has the above data splitted by lines and whitespaces . any idea on this SEDCMD pls?

Re: Can i remove blank lines in my event ??

martin_mueller — Fri, 15 Nov 2013 13:15:56 GMT

Give this a try:

SEDCMD-spaces = s/[\n\r]+|\s\s+//g

Re: Can i remove blank lines in my event ??

rakesh_498115 — Mon, 18 Nov 2013 13:19:33 GMT

Hi Martin..thanks for the update .. but this is working in query.but not working in props.conf..

myquery:

index="default" sourcetype="mydata" source="/splunkInput/Parsing/parse4.1_2013-07-2616.32.15.log" | rex mode=sed "s/*//g" | rex mode=sed "s/[\n\r]+|\s\s+//g"

Re: Can i remove blank lines in my event ??

martin_mueller — Mon, 18 Nov 2013 15:30:48 GMT

What's your props.conf content?

Re: Can i remove blank lines in my event ??

rakesh_498115 — Mon, 28 Sep 2020 15:18:37 GMT

Hi martin, Here is my props setting,

[mydata]
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = true
pulldown_type = 1
SEDCMD-parse1 = s/*//g
SEDCMD-parse2 = s/[\n\r]+|\s\s+//g

I have used above parse s/*//g to remove the special * which is avaiable in my log data along with blank lines and whitespaces ..

Re: Can i remove blank lines in my event ??

martin_mueller — Wed, 20 Nov 2013 08:41:35 GMT

This works for me in props.conf:

[foo]
SEDCMD-spaces = s/[\n\r]+|\s\s+//g
TIME_FORMAT = %d-%b-%y:%H-%M-%S

for turning this:

26-JUL-13:10-23-34 <Envelop          e>    

<sample

>
Text


</sample>

</    Envelope    >

into this:

26-JUL-13:10-23-34 <Envelope><sample>Text</sample></Envelope>

Note: Depending on your XML, removing all multi-space blocks entirely may damage the XML. For example, if you have this:

<foo  bar="baz" />

and remove the double space to get this:

<foobar="baz" />

you may be in trouble.