Getting Data In

Can I get the length of a replacement or SEDCMD removal?

dart
Splunk Employee
Splunk Employee

If I have a SEDCMD that is removing data, can I get the length of data removed, eg:

### RAW EVENT
12:01:01 Recieved message : "The Quick Brown Fox Jumps Over The Lazy Dog"

### props.conf
[messages]
SEDCMD-censor = s/message : "[^"]+"/message : "XXX"/

### transformed event
12:01:01 Recieved message : "XXX"

### desired transformed event
12:01:01 Recieved message of length 44

Is this possible with SEDCMD or with a transform?

1 Solution

Ayn
Legend

No, you cannot. You'd need a scripted input to be able to achieve something like that.

View solution in original post

Ayn
Legend

No, you cannot. You'd need a scripted input to be able to achieve something like that.

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...