topic order of parsing: sedcmd and time_prefix in Getting Data In

order of parsing: sedcmd and time_prefix

tfechner — Fri, 20 Mar 2020 16:04:05 GMT

Hi,

we have a syslog message like:
Mar 20 16:27:09 hostname.com Mar 20 16:17:01 hostname 2020-20-03 16:27:02,486 hostname messsage

with a sedcmd I can remove the first part until the year.
Then I have:
2020-20-03 16:27:02,486 hostname messsage

If there is another timestring in the message I have to us TIME_RPEFIX in props.conf.
What regex do I have to use? Starting at line beginning (that is after sedcnd) oder on the initial message with a ittle bit more regex?

What is theparsing order splunk uses in props.conf? First sedcmd and the prefix or is stripping the very last thing splunk does with the event?

Torsten

Re: order of parsing: sedcmd and time_prefix

richgalloway — Fri, 20 Mar 2020 16:53:44 GMT

SEDCMD comes after TIME_PREFIX. See https://www.aplura.com/assets/pdf/props_conf_order.pdf

Re: order of parsing: sedcmd and time_prefix

tfechner — Wed, 30 Sep 2020 04:40:22 GMT

so first is: line_breaker,
then time_prefix and time string
then I strip with sedcmd

when will the event merged together in case of multiline events?

Re: order of parsing: sedcmd and time_prefix

richgalloway — Fri, 20 Mar 2020 18:01:48 GMT

That happens in the Aggregation Queue (before SEDCMD).