Getting Data In

Does "rex mode=sed" pass as SEDCMD regex check?

selenith
Engager

Hello. I'm attempting to reduce the volume of log message with full text of terms and conditions, through using SEDCMD command in props.conf at Indexer machine.
For that I created the following sed regex:

"s/(?<=General Terms and Conditions)(?s)(.*$)/.../g"

When i test it in Splunk using
| rex field=_raw mode=sed "s/(?<=General Terms and Conditions)(?s)(.*$)/.../g"
it replaces full text with "General Terms and Conditions..." which is good.

Does that mean that I can safely copy this in props.conf as SEDCMD="s/(?<=General Terms and Conditions)(?s)(.*$)/.../g" or syntax there is different? Asking because currently we have a single search-head|indexer machine which I can't restart freely each time I want to test something, so I'm looking for another way to make sure it will work.

Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The syntax is the same in props.conf, except the sed command string is not enclosed in quotation marks.

For test purposes, you may be able to install Splunk on your workstation and use a small sample of the data.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The syntax is the same in props.conf, except the sed command string is not enclosed in quotation marks.

For test purposes, you may be able to install Splunk on your workstation and use a small sample of the data.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...