Getting Data In

Does "rex mode=sed" pass as SEDCMD regex check?

selenith
Engager

Hello. I'm attempting to reduce the volume of log message with full text of terms and conditions, through using SEDCMD command in props.conf at Indexer machine.
For that I created the following sed regex:

"s/(?<=General Terms and Conditions)(?s)(.*$)/.../g"

When i test it in Splunk using
| rex field=_raw mode=sed "s/(?<=General Terms and Conditions)(?s)(.*$)/.../g"
it replaces full text with "General Terms and Conditions..." which is good.

Does that mean that I can safely copy this in props.conf as SEDCMD="s/(?<=General Terms and Conditions)(?s)(.*$)/.../g" or syntax there is different? Asking because currently we have a single search-head|indexer machine which I can't restart freely each time I want to test something, so I'm looking for another way to make sure it will work.

Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The syntax is the same in props.conf, except the sed command string is not enclosed in quotation marks.

For test purposes, you may be able to install Splunk on your workstation and use a small sample of the data.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The syntax is the same in props.conf, except the sed command string is not enclosed in quotation marks.

For test purposes, you may be able to install Splunk on your workstation and use a small sample of the data.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!