Getting Data In

Complicated extraction in props.conf


The jist of the search is that it removes lots of infomation from _raw and gives me back whats left AS msgdigest.

index=auth |rex mode=sed "s/[a-z]+\d{1,4}//" |rex mode=sed "s/user\s[a-z]+/user /" |rex mode=sed "s/(user|USER)=[a-z]+/user=/" |rex mode=sed "s/\d+//g" |rex mode=sed "s/(Jan|January|Feb|Febuary|Mar|March|Apr|April|May|Jun|June|Jul|July|Aug|August|Sep|September|Oct|October|Nov|November|Dec|December|Mon|Tue|Wed|Thu|Fri|Sat|Sun|PM|AM|PDT|PST)//g" |rex mode=sed "s/\s+/_/g"| rename _raw AS msgdigest |stats count by msgdigest

I want to find a way to make this work in prop.conf (or if I have to also using transforms.conf). Appreciate the help!!!!

Tags (2)
0 Karma

Ultra Champion

If you wish to do this at index time, and permanently remove the data before it's even written to an index, you can use SEDCMD in props.conf.

However, I don't think you should remove any timestamps.

Hope this helps,


0 Karma


The goal is not to remove permanently (you are right in thinking that would be bad 😉 but instead to have a new field without the parts I took out from _raw.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...