topic Re: Replace before importing the data in splunk in Getting Data In

Replace before importing the data in splunk

abhayneilam — Sun, 04 Nov 2012 16:59:42 GMT

Hi,
I have a file which contains the below content:

I want to replace "|" to "\ |" before importing to the splunk, I have heard that it is possible if I write it in props.conf but it is not working, Kindly suggest me how to solve this problem as this is needed in urgent basis

Thanks in advance

Re: Replace before importing the data in splunk

lrhazi — Sun, 04 Nov 2012 18:14:33 GMT

Maybe this is what you need: http://docs.splunk.com/Documentation/Splunk/5.0/Data/Anonymizedatausingconfigurationfiles

Re: Replace before importing the data in splunk

abhayneilam — Sun, 04 Nov 2012 18:51:53 GMT

I am trying to use in props.conf but it is not working kindly help me out with some real example

Thanks for your help

Re: Replace before importing the data in splunk

lrhazi — Sun, 04 Nov 2012 19:02:34 GMT

The page linked before shows really examples. No?

You should show the relevant part of your props.conf so people can help you.

I have not used this before, but I would try something like:

[source::.../abc.log]
SEDCMD-abc = y/|/ |/

That's trying to say: replace any "|" with " |"

Re: Replace before importing the data in splunk

lrhazi — Sun, 04 Nov 2012 19:04:14 GMT

That should be:

[source::.../abc.log]
SEDCMD-abc = s/|/ |/g

s for substitute, and g for global, replace all occurrences, not just the first.

Re: Replace before importing the data in splunk

abhayneilam — Sun, 04 Nov 2012 19:31:41 GMT

[haha]
SHOULD_LINEMERGE = False
SEDCMD-dekh=s/|/ |/g
REPORT-dekh=dekhbhai

this is my props.conf but it is not working properly

Re: Replace before importing the data in splunk

lrhazi — Sun, 04 Nov 2012 19:51:20 GMT

What is "haha" ?
also, try and add a back slash "\" before the first pipe character in the sed command. this forum seems to remove my backslashes:

SEDCMD-dekh=s/|/ |/g

Re: Replace before importing the data in splunk

gkanapathy — Mon, 05 Nov 2012 02:19:44 GMT

Unclear to me why you want to do this, or why this would be helpful to you after the data has been imported.

Re: Replace before importing the data in splunk

smolcj — Mon, 05 Nov 2012 09:20:20 GMT

i have the same problem, how to replace \ with \\ while searching?
thankyou for ur time

Re: Replace before importing the data in splunk

Ayn — Mon, 05 Nov 2012 15:53:33 GMT

You're trying to solve the wrong problem. The real problem is why your delimiters aren't working as they should.