All Apps and Add-ons
Highlighted

How to remove special character, from events whiling indexing

Engager

In my logs we have, special character like \r\n\t, i like remove from events while index level. Please help me on this.

Example: we have like this events\r\n\t\t\t\t\t

0 Karma
Highlighted

Re: How to remove special character, from events whiling indexing

SplunkTrust
SplunkTrust

Splunk provides a way to mask sensitive data (replace sensitive data with different string). You can use same concept to replace those junk character with nothing (effectively removing them from raw data). See this for more information.
https://docs.splunk.com/Documentation/Splunk/7.1.3/Data/Anonymizedata

Again, a better option would to be to fix the source that generates the data.

0 Karma
Highlighted

Re: How to remove special character, from events whiling indexing

Esteemed Legend

The best way is to do this:

SHOULD_LINEMERGE = false
LINEBREAKER = ([\r\n\t]+)
0 Karma