Getting Data In
Highlighted

How can SEDCMD be used to extract and modify KV pairs from multiline events?

Explorer

Here is a sample event I am attempting to parse and substitute 'SomeData=.*Transaction Type : ' with 'TxnType='

DT=2018-01-23T14:29:56.456-0800 | AppId=R4 |AppInst=SIMULATOR:201801231429 |LogId=TxLog |TxCode=Zoom | Level=INFO |SomeData=[UID:xxxxxxxxxxxx:SIMULATOR:2018012314, Message Timestamp:2018-01-23 14:29:55.976] [Zoom Result Code : ]
[Fun : 00]
[Transaction Identifier : 987xxxxxxxxxxxxx]
[Transaction Type : 00]
[More Fun : 00]

I have made various attempts. Here is my latest...

SEDCMD-all = s/SomeData=[.\r\n]+Transaction\sType\s:\s/TxnType=/g

0 Karma
Highlighted

Re: How can SEDCMD be used to extract and modify KV pairs from multiline events?

SplunkTrust
SplunkTrust

Hi,

Can you please try this?

SEDCMD-all = s/(?s)SomeData=.*\[Transaction\sType\s\:/TxnType=/g
0 Karma
Highlighted

Re: How can SEDCMD be used to extract and modify KV pairs from multiline events?

Explorer

Excellent! Much appreciated.... I had tried the flags prior, but another portion of the expression must not have been correct. Thanks!

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.