topic json SED problem in Getting Data In

json SED problem

General_Talos — Mon, 05 Jul 2021 12:15:06 GMT

Hi ,

I am having json logs which I on-boarded to Splunk

{"body":{"records": {"time": "2020-12-20T13:28:50.2164144Z","MachineGroup": "Windows 10", "Timestamp": "2020-12-20T13:27:18.6679858Z", "DeviceName": "3242d4e4.dc.democorp.com", "ReportId": 306737}}},"x-opt-sequence-number":159959006,"x-opt-offset":"2713650553292728","x-opt-enqueued-time":1624195823422}

I am trying to remove everything after "}}}" with SEDCMD and my props.conf is below-mentioned

[json_log] LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true category = Custom disabled = false INDEXED_EXTRACTIONS = json KV_MODE = none DATETIME_CONFIG = CURRENT TRUNCATE = 0 SEDCMD-unwantedfields=s/\}\}\}(.*)/g

Fields are not in raw logs, however when expending details can see the field values

Any suggestion, what I am doing wrong ?

https://regex101.com/r/btYSah/1

Re: json SED problem

kamlesh_vaghela — Mon, 05 Jul 2021 14:51:14 GMT

@General_Talos

Can you please try this?

[json_log] SHOULD_LINEMERGE=true LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true SEDCMD-unwantedfields=s/\}\}\}(.*)/}}}/g

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: json SED problem

General_Talos — Mon, 05 Jul 2021 16:57:18 GMT

Thanks @kamlesh

Minor changes, resulted in required result.

SEDCMD-unwantedfields=s/\}\}\}(.*)\}/g