topic Re: Remove first four lines of field in Splunk Search

Remove first four lines of field

calarie001 — Tue, 29 Sep 2020 20:36:01 GMT

I want to display each event's raw text in a table column, but I need to remove the first four lines of the field (terminal_id, operator_id, date, and time lines). Is there a way I can always 'hide' the first four lines of the field before displaying it in a dashboard table at searchtime?

This is what the field looks like:
CA7_TERMINAL_ID= data here!

CA7_OPERATOR_ID= data here!

CA7_DATE= data here!

CA7_TIME= data here!

CA7_TRANSACTION= data here!

CA7_JOB= data here!

CA7_SYSTEM= data here!

CA7_DESC= data here!

CA7_ACTIVE_SIZE=data here !

CA7_PROGRAM= data here!

CA7_MESSAGE= data here!

Re: Remove first four lines of field

gcusello — Tue, 24 Jul 2018 14:41:24 GMT

Hi calarie001,
in you dashboard panels do you use table command to define which fields to display or do you display raw data?
In the first case you can choose which fields to display

index=my_index
| table CA7_TIME CA7_TRANSACTION CA7_JOB CA7_SYSTEM CA7_DESC CA7_ACTIVE_SIZE CA7_PROGRAM CA7_MESSAGE

Bye.
Giuseppe

Re: Remove first four lines of field

HiroshiSatoh — Tue, 24 Jul 2018 14:46:45 GMT

If the number of logs is large, it is slow.

(your search)|streamstats count by rec_no
|eval CA7_TERMINAL_ID=if(rec_no<5,"",CA7_TERMINAL_ID)
|eval CA7_OPERATOR_ID=if(rec_no<5,"",CA7_OPERATOR_ID)
|eval CA7_DATE=if(rec_no<5,"",CA7_DATE)
|eval CA7_TIME=if(rec_no<5,"",CA7_TIME)

Re: Remove first four lines of field

woodcock — Tue, 24 Jul 2018 15:42:09 GMT

It really, really, really, really helps to see you raw events and your search. Because you keep referring to this dataset as a field I am assuming that this is a single event and that you need to strip out that data. This seems unlikely but...

Try this

Your Search Here
| rex field=YourFieldNameHere mode=sed "s/^.*?CA7_TIME=[^\n\r\s]+//"