Getting Data In

Can I get the length of a replacement or SEDCMD removal?

dart
Splunk Employee
Splunk Employee

If I have a SEDCMD that is removing data, can I get the length of data removed, eg:

### RAW EVENT
12:01:01 Recieved message : "The Quick Brown Fox Jumps Over The Lazy Dog"

### props.conf
[messages]
SEDCMD-censor = s/message : "[^"]+"/message : "XXX"/

### transformed event
12:01:01 Recieved message : "XXX"

### desired transformed event
12:01:01 Recieved message of length 44

Is this possible with SEDCMD or with a transform?

1 Solution

Ayn
Legend

No, you cannot. You'd need a scripted input to be able to achieve something like that.

View solution in original post

Ayn
Legend

No, you cannot. You'd need a scripted input to be able to achieve something like that.

Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...