topic Re: Multiple SEDCMDs in Splunk Search

Multiple SEDCMDs

ephemeric — Thu, 19 Apr 2012 19:47:05 GMT

Greetz,

Does anyone know if multiple SEDCMDs are supported at index time in props.conf?

Also, can I implement this search through a regex transform or any other way?

sourcetype="vul:foresight" | rex mode=sed "s/\\\\\\//\\//g" | rex mode=sed "s/\\\n/\n/g" | rex mode=sed "s/<13>.*\.\.\.//g" | rex mode=sed "s/\.\.\..*\n//g" | rex mode=sed "s/^<13>//g"

Thank you.

Re: Multiple SEDCMDs

ephemeric — Fri, 20 Apr 2012 20:39:52 GMT

You can do multiple SEDCMDs for the same sourcetype but not in the same props.conf file I found!

Re: Multiple SEDCMDs

the_wolverine — Tue, 20 Aug 2013 21:56:38 GMT

Actually you can use multiple SEDCMDs in the same props.conf and for the same sourcetype:

[vul:foresight]
SEDCMD-first = s/\\\//\//g
SEDCMD-second = s/\\n/\n/g
SEDCMD-third = s/<13>.*...//g
etc.

Re: Multiple SEDCMDs

cpeteman — Tue, 20 Aug 2013 22:08:19 GMT

Does anyone have the answer for the second part of his question?

Re: Multiple SEDCMDs

ephemeric — Wed, 21 Aug 2013 07:40:02 GMT

Thank you! Brilliant.