My "rex mode=sed" works in search, but why does it not work configuring with SEDCMD in props.conf?

[TiagoMatos]

Hello,

I tried this

index=s4 *Error* | rex mode=sed field=_raw "s/(\w+\tError\t\d\t[^\t]*\s\d{4}\-\d{2}\-\d{2}\s\d{2}\:\d{2}\:\d{2}\s\([^\s]*\s)(\(\d+\)\)\s\w{3}\-\w{3}\-\d{5})(.*)/\2/g"

It works perfectly returning (1420)) SBL-UIF-00401 from

ObjMgrLog   Error   1   000f012e567243f0:0  2015-12-17 14:51:53 (cxsesmgr.cpp (655)) SBL-CFG-00157: O motor de execução do Siebel Product Configurator não foi inicializado.

When trying to put it on SEDCMD from props.conf:

SEDCMD-Error=s/(\w+\tError\t\d\t[^\t]*\s\d{4}\-\d{2}\-\d{2}\s\d{2}\:\d{2}\:\d{2}\s\([^\s]*\s)(\(\d+\)\)\s\w{3}\-\w{3}\-\d{5})(.*)/\2/

This doesn't substitute anything that it should!

Can anyone help me?

Thanks

[somesoni2 · Accepted solution]

Have a look at definition of the SEDCMD in props.conf from here

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

In summary, it's only used at index time, so should be configured on Indexer/Heavy Forwarder and will work for any future data only. Existing data will not get modified.

You sure you want to update _raw (raw data) to just that value OR instead, extract the value as a field?? If it's the later, try this in your searches.

 index=s4 *Error* | rex "^(\S+\s+){8}(?<FieldName>\S+):"

You can put the field extraction in props.conf on Search Head like this

[sourcetypeName]
EXTRACT-fieldname = ^(\S+\s+){8}(?<FieldName>\S+):