How to Remove event prefix from JSON using SEDCMD in props.conf?

iamsplunker — Tue, 12 Sep 2023 21:15:17 GMT

Hi Splunk community,

I've JSON logs and I wanted to remove the prefix from the events and capture from {"successfulSetoflog
until AZURE API Health Event"}

Sample Event:

2020-02-10T17:42:41.088Z 775ab4c6-ccc3-600b-9c84-124320628f00 {"records": [{"value": {"successfulSetoflog": [{"awsAccountId": "123456789123", "event": {"arn": "arn:aws:health:us-east-........................................................ 1}, "detail-case": "AZURE API Health Event"}}]}

The expected output would be

{"successfulSetoflog": [{"awsAccountId": "123456789123", "event": {"arn": "arn:aws:health:us-east-........................................................ 1}, "detail-case": "AZURE API Health Event"}

Re: Remove event prefix from JSON using SEDCMD in props.conf

iamsplunker — Tue, 12 Sep 2023 01:28:06 GMT

By applying these settings in props.conf the prefix was removed and events are parsing as expected.

SEDCMD-1=s/^[^\{]+{"records":\s+\[\{"value":\s//

SEDCMD-2=s/}\]\}//

topic Re: Remove event prefix from JSON using SEDCMD in props.conf in Splunk Search

How to Remove event prefix from JSON using SEDCMD in props.conf?

Re: Remove event prefix from JSON using SEDCMD in props.conf