Getting Data In

Can I get the length of a replacement or SEDCMD removal?

Splunk Employee
Splunk Employee

If I have a SEDCMD that is removing data, can I get the length of data removed, eg:

### RAW EVENT
12:01:01 Recieved message : "The Quick Brown Fox Jumps Over The Lazy Dog"

### props.conf
[messages]
SEDCMD-censor = s/message : "[^"]+"/message : "XXX"/

### transformed event
12:01:01 Recieved message : "XXX"

### desired transformed event
12:01:01 Recieved message of length 44

Is this possible with SEDCMD or with a transform?

1 Solution

Legend

No, you cannot. You'd need a scripted input to be able to achieve something like that.

View solution in original post

Legend

No, you cannot. You'd need a scripted input to be able to achieve something like that.

View solution in original post