Can i remove blank lines in my event ??

[rakesh_498115]

Hi

I have an so many blanklines , and whitespaces in a single event , Now i want to strip of these blank lines , and mutliple whitespaces ignoring a single whitespace. How can i do this using SEDCMD prop in props.conf

I have tried the following configuration,in props.conf

SEDCMD-parse1 = s/(?m)\n//g s/ *//g

s/(?m)\n//g - to remove blanklines
s/ *//g - to remove mutliple whitespaces

but this doesnt work ? any better idea of doing this pls ?

My sample event :

`
26-JUL-13:10-23-34

<sample

Text

</ Envelope >
`

Now i am expecting the following output,

26-JUL-13:10-23-34 Text

Sry i am unable to post sample event also, it has the above data splitted by lines and whitespaces . any idea on this SEDCMD pls?

[martin_mueller]

Give this a try:

SEDCMD-spaces = s/[\n\r]+|\s\s+//g

[martin_mueller]

This works for me in props.conf:

[foo]
SEDCMD-spaces = s/[\n\r]+|\s\s+//g
TIME_FORMAT = %d-%b-%y:%H-%M-%S

for turning this:

26-JUL-13:10-23-34 <Envelop          e>    

<sample

>
Text


</sample>

</    Envelope    >

into this:

26-JUL-13:10-23-34 <Envelope><sample>Text</sample></Envelope>

Note: Depending on your XML, removing all multi-space blocks entirely may damage the XML. For example, if you have this:

<foo  bar="baz" />

and remove the double space to get this:

<foobar="baz" />

you may be in trouble.

[rakesh_498115]

Hi martin, Here is my props setting,

[mydata]
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = true
pulldown_type = 1
SEDCMD-parse1 = s/*//g
SEDCMD-parse2 = s/[\n\r]+|\s\s+//g

I have used above parse s/*//g to remove the special * which is avaiable in my log data along with blank lines and whitespaces ..

[martin_mueller]

What's your props.conf content?

[rakesh_498115]

Hi Martin..thanks for the update .. but this is working in query.but not working in props.conf..

myquery:

index="default" sourcetype="mydata" source="/splunkInput/Parsing/parse4.1_2013-07-2616.32.15.log" | rex mode=sed "s/*//g" | rex mode=sed "s/[\n\r]+|\s\s+//g"