Getting Data In

Can I get the length of a replacement or SEDCMD removal?

dart
Splunk Employee
Splunk Employee

If I have a SEDCMD that is removing data, can I get the length of data removed, eg:

### RAW EVENT
12:01:01 Recieved message : "The Quick Brown Fox Jumps Over The Lazy Dog"

### props.conf
[messages]
SEDCMD-censor = s/message : "[^"]+"/message : "XXX"/

### transformed event
12:01:01 Recieved message : "XXX"

### desired transformed event
12:01:01 Recieved message of length 44

Is this possible with SEDCMD or with a transform?

1 Solution

Ayn
Legend

No, you cannot. You'd need a scripted input to be able to achieve something like that.

View solution in original post

Ayn
Legend

No, you cannot. You'd need a scripted input to be able to achieve something like that.

Get Updates on the Splunk Community!

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...

Introducing New Splunkbase Governance!

Splunk apps are essential for maximizing the value of your Splunk Experience. Whether you’re using the default ...

3 Ways to Make OpenTelemetry Even Better

My role as an Observability Specialist at Splunk provides me with the opportunity to work with customers of ...