topic Re: How should i do SEDCMD filter URL? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-should-i-do-SEDCMD-filter-URL/m-p/44557#M10506 <P>I'm sorry chengyu, it's not very clear to me what you are asking or what you are trying to achieve.</P> Fri, 23 Aug 2013 12:15:59 GMT rturk 2013-08-23T12:15:59Z How should i do SEDCMD filter URL? https://community.splunk.com/t5/Splunk-Search/How-should-i-do-SEDCMD-filter-URL/m-p/44556#M10505 <P>I have use Heave Forward and modify props.conf</P> <P>source:...</P> <PRE><CODE>SEDCMD-nourl = s/\surl=("\w+"|"\w+\[./\]"|)\s/ /g </CODE></PRE> <P>RAW data:<BR /> i.g:</P> <PRE><CODE>url="N/A" -----OK </CODE></PRE> <P>or</P> <PRE><CODE>url="/bases/av/kdb/i386/kdb-i386-1211g.xml.dif" ----Fail </CODE></PRE> <P>or</P> <PRE><CODE>url="/SimpleAuthWebService/SimpleAuth.asmx" ----- Fail </CODE></PRE> <P>How should i do?</P> <P>Thank you!</P> Fri, 23 Aug 2013 11:51:16 GMT https://community.splunk.com/t5/Splunk-Search/How-should-i-do-SEDCMD-filter-URL/m-p/44556#M10505 chengyu 2013-08-23T11:51:16Z Re: How should i do SEDCMD filter URL? https://community.splunk.com/t5/Splunk-Search/How-should-i-do-SEDCMD-filter-URL/m-p/44557#M10506 <P>I'm sorry chengyu, it's not very clear to me what you are asking or what you are trying to achieve.</P> Fri, 23 Aug 2013 12:15:59 GMT https://community.splunk.com/t5/Splunk-Search/How-should-i-do-SEDCMD-filter-URL/m-p/44557#M10506 rturk 2013-08-23T12:15:59Z Re: How should i do SEDCMD filter URL? https://community.splunk.com/t5/Splunk-Search/How-should-i-do-SEDCMD-filter-URL/m-p/44558#M10507 <P>Could this work? Should remove the string 'url=' and all non-space characters directly following it.</P> <PRE><CODE>SEDCMD-nourl = s/\surl=\S+/ /g </CODE></PRE> <P>EDIT: small change to replace url with " " instead of <CODE>\s</CODE>.</P> <P>Hope this helps,</P> <P>K</P> Fri, 23 Aug 2013 13:08:18 GMT https://community.splunk.com/t5/Splunk-Search/How-should-i-do-SEDCMD-filter-URL/m-p/44558#M10507 kristian_kolb 2013-08-23T13:08:18Z Re: How should i do SEDCMD filter URL? https://community.splunk.com/t5/Splunk-Search/How-should-i-do-SEDCMD-filter-URL/m-p/44559#M10508 <P>Thank you kindly support!</P> Fri, 23 Aug 2013 15:25:54 GMT https://community.splunk.com/t5/Splunk-Search/How-should-i-do-SEDCMD-filter-URL/m-p/44559#M10508 chengyu 2013-08-23T15:25:54Z Re: How should i do SEDCMD filter URL? https://community.splunk.com/t5/Splunk-Search/How-should-i-do-SEDCMD-filter-URL/m-p/44560#M10509 <P>Thank you kindly support!</P> Fri, 23 Aug 2013 15:41:58 GMT https://community.splunk.com/t5/Splunk-Search/How-should-i-do-SEDCMD-filter-URL/m-p/44560#M10509 chengyu 2013-08-23T15:41:58Z