Getting Data In

My "rex mode=sed" works in search, but why does it not work configuring with SEDCMD in props.conf?

TiagoMatos
Path Finder

Hello,

I tried this

index=s4 *Error* | rex mode=sed field=_raw "s/(\w+\tError\t\d\t[^\t]*\s\d{4}\-\d{2}\-\d{2}\s\d{2}\:\d{2}\:\d{2}\s\([^\s]*\s)(\(\d+\)\)\s\w{3}\-\w{3}\-\d{5})(.*)/\2/g"

It works perfectly returning (1420)) SBL-UIF-00401 from

ObjMgrLog   Error   1   000f012e567243f0:0  2015-12-17 14:51:53 (cxsesmgr.cpp (655)) SBL-CFG-00157: O motor de execução do Siebel Product Configurator não foi inicializado.

When trying to put it on SEDCMD from props.conf:

SEDCMD-Error=s/(\w+\tError\t\d\t[^\t]*\s\d{4}\-\d{2}\-\d{2}\s\d{2}\:\d{2}\:\d{2}\s\([^\s]*\s)(\(\d+\)\)\s\w{3}\-\w{3}\-\d{5})(.*)/\2/

This doesn't substitute anything that it should!

Can anyone help me?

Thanks

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Have a look at definition of the SEDCMD in props.conf from here

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

In summary, it's only used at index time, so should be configured on Indexer/Heavy Forwarder and will work for any future data only. Existing data will not get modified.

You sure you want to update _raw (raw data) to just that value OR instead, extract the value as a field?? If it's the later, try this in your searches.

 index=s4 *Error* | rex "^(\S+\s+){8}(?<FieldName>\S+):"

You can put the field extraction in props.conf on Search Head like this

[sourcetypeName]
EXTRACT-fieldname = ^(\S+\s+){8}(?<FieldName>\S+):

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Have a look at definition of the SEDCMD in props.conf from here

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

In summary, it's only used at index time, so should be configured on Indexer/Heavy Forwarder and will work for any future data only. Existing data will not get modified.

You sure you want to update _raw (raw data) to just that value OR instead, extract the value as a field?? If it's the later, try this in your searches.

 index=s4 *Error* | rex "^(\S+\s+){8}(?<FieldName>\S+):"

You can put the field extraction in props.conf on Search Head like this

[sourcetypeName]
EXTRACT-fieldname = ^(\S+\s+){8}(?<FieldName>\S+):
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...