<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Help with SEDCMD-drop in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Help-with-SEDCMD-drop/m-p/491315#M83947</link>
    <description>&lt;P&gt;Here is my issue, i have logs that look like this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;--CT&amp;lt;-- --------------------------------------------------
10:10:23 AM  Application Directory: A:\bdir\Cdir\Aapp
The last GET occurred at 1/24/2020 10:10:23 AM
-------------------------------------------------- --&amp;gt;
--/&amp;gt;
&amp;lt;--CT&amp;lt;-- --------------------------------------------------
10:10:20 AM  Application Directory: A:\bdir\Cdir\Bapp
The last GET occurred at 1/24/2020 10:10:20 AM
-------------------------------------------------- --&amp;gt;
--/&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;When use the following  &lt;CODE&gt;SEDCMD-drop = s/&amp;lt;--CT&amp;lt;-- |-+| --&amp;gt;|&amp;gt;|\/&amp;gt;//g&lt;/CODE&gt; I get&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;10:10:23 AM  Application Directory: A:\bdir\Cdir\Aapp
The last GET occurred at 1/24/2020 10:10:23 AM



10:10:20 AM  Application Directory: A:\bdir\Cdir\Bapp
The last GET occurred at 1/24/2020 10:10:20 AM
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;How do I go about getting rid those extra blank lines?&lt;/P&gt;</description>
    <pubDate>Fri, 24 Jan 2020 19:46:02 GMT</pubDate>
    <dc:creator>cboillot</dc:creator>
    <dc:date>2020-01-24T19:46:02Z</dc:date>
    <item>
      <title>Help with SEDCMD-drop</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Help-with-SEDCMD-drop/m-p/491315#M83947</link>
      <description>&lt;P&gt;Here is my issue, i have logs that look like this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;--CT&amp;lt;-- --------------------------------------------------
10:10:23 AM  Application Directory: A:\bdir\Cdir\Aapp
The last GET occurred at 1/24/2020 10:10:23 AM
-------------------------------------------------- --&amp;gt;
--/&amp;gt;
&amp;lt;--CT&amp;lt;-- --------------------------------------------------
10:10:20 AM  Application Directory: A:\bdir\Cdir\Bapp
The last GET occurred at 1/24/2020 10:10:20 AM
-------------------------------------------------- --&amp;gt;
--/&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;When use the following  &lt;CODE&gt;SEDCMD-drop = s/&amp;lt;--CT&amp;lt;-- |-+| --&amp;gt;|&amp;gt;|\/&amp;gt;//g&lt;/CODE&gt; I get&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;10:10:23 AM  Application Directory: A:\bdir\Cdir\Aapp
The last GET occurred at 1/24/2020 10:10:23 AM



10:10:20 AM  Application Directory: A:\bdir\Cdir\Bapp
The last GET occurred at 1/24/2020 10:10:20 AM
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;How do I go about getting rid those extra blank lines?&lt;/P&gt;</description>
      <pubDate>Fri, 24 Jan 2020 19:46:02 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Help-with-SEDCMD-drop/m-p/491315#M83947</guid>
      <dc:creator>cboillot</dc:creator>
      <dc:date>2020-01-24T19:46:02Z</dc:date>
    </item>
    <item>
      <title>Re: Help with SEDCMD-drop</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Help-with-SEDCMD-drop/m-p/491316#M83948</link>
      <description>&lt;P&gt;Include line ends in your regex and it should eliminate the blank lines.&lt;/P&gt;

&lt;P&gt;&lt;CODE&gt;SEDCMD-drop = s/&amp;lt;--CT&amp;lt;-- |-+\n?| --&amp;gt;\n|&amp;gt;|\/&amp;gt;\n//g&lt;/CODE&gt;&lt;/P&gt;</description>
      <pubDate>Fri, 24 Jan 2020 20:38:01 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Help-with-SEDCMD-drop/m-p/491316#M83948</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2020-01-24T20:38:01Z</dc:date>
    </item>
    <item>
      <title>Re: Help with SEDCMD-drop</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Help-with-SEDCMD-drop/m-p/491317#M83949</link>
      <description>&lt;P&gt;Although this didn't work 100% for me ( it added an / to a 3rd line), it got me going in the right direction, what I ended up using was &lt;CODE&gt;SEDCMD-drop = s/&amp;lt;--CT&amp;lt;-- |-+\n?| --&amp;gt;\n|&amp;gt;|\/&amp;gt;//g&lt;/CODE&gt;&lt;/P&gt;</description>
      <pubDate>Fri, 24 Jan 2020 20:54:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Help-with-SEDCMD-drop/m-p/491317#M83949</guid>
      <dc:creator>cboillot</dc:creator>
      <dc:date>2020-01-24T20:54:38Z</dc:date>
    </item>
  </channel>
</rss>

