Getting Data In

How to configure SEDCMD in props.conf to delete XML event content at index-time?

Contributor

Hi all -

I have content in XML events I'm indexing that I don't want:

<?xml version="1.0" encoding="UTF-8"?>

So I decided to use sedcmd in my props.conf like follows:

SEDCMD-header = <\?xml version\=\"1\.0\" encoding\=\"UTF\-8\"\?>

Alas, it does not work. I feel it may be the regex that is failing, but I cannot seem to get it to click.

Can anyone help?

Tags (3)
1 Solution

SplunkTrust
SplunkTrust

Try something like this in your props.conf on Indexer/Heavy Forwarder

[Yoursourcetype]
...Other configurations...
SEDCMD-aremoveheader = s/^\<\?xml[^\>]*\>\n*//g

View solution in original post

Esteemed Legend

Try this:

 SEDCMD-header = s/<?xml version="1.0" encoding="UTF-8"?>//

You need to have a full sed command, in this case it says to switch your string with nothing.

0 Karma

SplunkTrust
SplunkTrust

Try something like this in your props.conf on Indexer/Heavy Forwarder

[Yoursourcetype]
...Other configurations...
SEDCMD-aremoveheader = s/^\<\?xml[^\>]*\>\n*//g

View solution in original post

Motivator

You want to make sure to capture the last ">" too. Maybe even the line characters afterwards.

SEDCMD-aremoveheader = s/^\<\?xml[^\>]*\>\n*//g

SplunkTrust
SplunkTrust

Good catch. Just updated the my answer to reflect that.

0 Karma