Getting Data In

How can I remove some parenthesis from this log?

daniel333
Builder

All,

I am trying to convert some superfluous parenthesis from this log. Duration value can be up to 4 digits.

Looks like
1/2/2017 12:34 severity=INFO post call (duration=5)

What I want
1/2/2017 12:34 severity=INFO post call duration=5

Here is what I got so far, but not clicking.
SEDCMD-log4jwild_fix_duration_parenth = s/((duration=(0-9)*))/\1/

Any ideas?

0 Karma

mayurr98
Super Champion

Try this run anywhere search, below will look only for duration fieldand remove the brackets from duration field only.

| makeresults 
| eval data="1/2/2017 12:34 severity=INFO post call (duration=5)" 
| rex field=data mode=sed "s/\((duration=[^\)]+)\)/\1/"

Here is what you should write in your environment:

SEDCMD-log4jwild_fix_duration_parenth = s/\((duration=[^\)]+)\)/\1/

let me know if this helps!

0 Karma

ddrillic
Ultra Champion

What about a sed command which would replace either ( or ) with nothing?

0 Karma

493669
Super Champion

have you tried below answer.. it will remove ( and )

0 Karma

493669
Super Champion

Try this:

SEDCMD-log4jwild_fix_duration_parenth = s/([^\(]+)\(([^\)]+)\)/\1\2/
0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...