topic Re: ignore the raw event using heavy forworder in Getting Data In

ignore the raw event using heavy forworder

nerelluk — Sun, 16 Jun 2019 04:24:35 GMT

Hi ALL,

could anyone help use to parsing/trimming of the raw event using heavy forworders?

Plzz find the attached screenshot .i want to ignore the rest of the events except few tags that I was highlighted.

I request you to provide me proper configuration.

Thanks,
Nerellu

Re: ignore the raw event using heavy forworder

jkat54 — Sun, 16 Jun 2019 12:39:56 GMT

See props.conf and SEDCMD.

If you're new to regular expression use regex101.com to help you build the correct regexes.

You will need the SEDCMD in props on the first "heavy" splunk that receives the data.

Re: ignore the raw event using heavy forworder

richgalloway — Sun, 16 Jun 2019 13:02:34 GMT

If the fields are always in the same order, you should be able to do it using SEDCMD. Add this line to your props.conf file:

SEDCMD-record = s/\<L:RECORD>.*?(\<L:EPOCH>.*?\<\/L:EPOCH>)[\S\s]+(\<L:MESSAGEID>.*?\<\/L:MESSAGEID>)[\S\s]+(\<L:TEXT>.*?\<\/L:TEXT>).*\<\/L:RECORD>/$1$2$3/

Re: ignore the raw event using heavy forworder

woodcock — Sun, 16 Jun 2019 23:21:42 GMT

As others have said, use SEDCMD and use capture groups to grab your stuff so it would look something like this:

SEDCMD-reduceraw = s/^firstSkipRegEx(firstCaptureRegEx)secondSkipRegEx(secondCaptureRegEx)thirdSkipRegEx(thirdCaptureRegEx).*$/\1,\2,\3/g