How to configure SEDCMD in props.conf to delete XML event content at index-time?

[himynamesdave]

Hi all -

I have content in XML events I'm indexing that I don't want:

<?xml version="1.0" encoding="UTF-8"?>

So I decided to use sedcmd in my props.conf like follows:

SEDCMD-header = <\?xml version\=\"1\.0\" encoding\=\"UTF\-8\"\?>

Alas, it does not work. I feel it may be the regex that is failing, but I cannot seem to get it to click.

Can anyone help?

[woodcock]

Try this:

 SEDCMD-header = s/<?xml version="1.0" encoding="UTF-8"?>//

You need to have a full sed command, in this case it says to switch your string with nothing.

[somesoni2 · Accepted solution]

Try something like this in your props.conf on Indexer/Heavy Forwarder

[Yoursourcetype]
...Other configurations...
SEDCMD-aremoveheader = s/^\<\?xml[^\>]*\>\n*//g

[landen99]

You want to make sure to capture the last ">" too. Maybe even the line characters afterwards.

SEDCMD-aremoveheader = s/^\<\?xml[^\>]*\>\n*//g

[somesoni2]

Good catch. Just updated the my answer to reflect that.