topic Re: issues with SEDCMD in Getting Data In

issues with SEDCMD

rusty009 — Fri, 07 Apr 2017 15:05:53 GMT

I have the below file being indexed in spunk,

{
    "records": 
    [

        { <event}}

and I would like to get rid of everything before {

so I'm executing the SEDCMD like below,

SEDCMD-StripHeader = s/{\s+\"records\":\s+\[\s+{/{/1

but it doesn't seem to be working. When I test it using the below splunk command it works a treat,

sourcetype="json:blob" | rex field=_raw mode=sed "s/{\s+\"records\":\s+\[\s+{/{/1"

I have restarted splunk, it's running on a single instance ( so this is my search head and indexer) - any ideas what I'm doing wrong?

Re: issues with SEDCMD

somesoni2 — Fri, 07 Apr 2017 15:36:06 GMT

Try with this

SEDCMD-StripHeader = s/^(\{\s+\"records\":\s+\[\s+)//

REGEX 101 link to see the regular exp working https://regex101.com/r/zkIXVa/1

Please note that SEDCMD is an index-time operation and would only affect any new event that come after you've configured it. Any existing event will not modified.

Re: issues with SEDCMD

rusty009 — Sat, 08 Apr 2017 13:17:03 GMT

that doesn't work unfortunately, is there an issue with my props.conf ?

Re: issues with SEDCMD

somesoni2 — Sat, 08 Apr 2017 21:44:47 GMT

The regex of your's works too. I guess if you've a copy of the file that you're monitoring available locally, you can test the SEDCMD command from Add data wizard. (Settings-> Add data -> Upload, go to advanced tab of left side bar and add SEDCMD of your).

Re: issues with SEDCMD

nawazns5038 — Fri, 05 Apr 2019 01:30:15 GMT

which is the best instance to add SEDCMD ??

Is it heavy forwarder or indexer ?