Escape literal $ at FORMAT of transforms.conf

Assaf_Katz — Wed, 27 Dec 2023 15:07:23 GMT

Hi,

I have the following transforms.conf:

[REPLACEMENT_COST] CLEAN_KEYS = 0 FORMAT = $1"REPLACEMENT_COST2":"$2$s"$3 REGEX = (.*)"REPLACEMENT_COST":([^,]+)(.*) #SOURCE_KEY = REPLACEMENT_COST DEST_KEY = _raw

I had to write s in the FORMAT field right after $, since otherwise, it does nothing. Is there any option to escape the dollar sign in this field?

The relevant props.conf is:

[json_multiline] DATETIME_CONFIG = INDEXED_EXTRACTIONS = json LINE_BREAKER = ([\r\n]+) MAX_DAYS_AGO = 10000 NO_BINARY_CHECK = true TIMESTAMP_FIELDS = LAST_UPDATE TIME_FORMAT = %m/%e/%y %H:%M category = Custom pulldown_type = 1 disabled = false KV_MODE = none EVAL-DESCRIPTION = replace(DESCRIPTION, "([A-Z])", " \1") EVAL-SPECIAL_FEATURES = split(replace(SPECIAL_FEATURES, "([A-Z])", " \1"), ",") LOOKUP-LANGUAGE = LANGUAGE.csv LANGUAGE_ID TRANSFORMS-REPLACEMENT = REPLACEMENT_COST

Thanks

Re: Escape literal $ at FORMAT of transforms.conf

isoutamo — Wed, 27 Dec 2023 15:17:07 GMT

usually character \ has used for escape character. I haven't try if this works also in your case, but you could try it like "\$" in your transforms.conf and see if it works or not.

r. Ismo

Re: Escape literal $ at FORMAT of transforms.conf

Assaf_Katz — Wed, 27 Dec 2023 15:48:23 GMT

Hi,

Thank you, but I tried and it doesn't work.

Thanks

topic Re: Escape literal $ at FORMAT of transforms.conf in Splunk Search

Escape literal $ at FORMAT of transforms.conf

Re: Escape literal $ at FORMAT of transforms.conf

Re: Escape literal $ at FORMAT of transforms.conf