I have a Json log which looks like this
Jul 11 14:37:48 darktrace-dt-722-01 darktrace {"creationTime":1562855937000,"breachUrl":...}
I have to remove the timestamp hostanem, all syslog prefixes until {
This is how my props.conf looks like
[darktrace]
SEDCMD-StripHeader = ^([^\{]+)
KV_MODE = json
pulldown_type = true
category = Structured
description = darktrace
But it doesn't work. I tried INDEXED_EXTRACTIONS = json as well without success.
Any help is appreciated. Thanks
It must be an actual sed command
like this:
SEDCMD-StripHeader = s/^[^\{]+//
It must be an actual sed command
like this:
SEDCMD-StripHeader = s/^[^\{]+//
Thank you @woodcock . I tried your suggested sed command but it did nothing.
If you are doing a sourcetype override/overwrite, you must use the ORIGINAL value NOT the new value, then you must deploy this to the first full instance(s) of Splunk that handles the events (usually either the HF-tier, if you use this, or your Indexer tier), restart all Splunk instances there, send in new events (old events will stay broken), then test using _index_earliest=-5m
to be absolutely certain that you are only examining the newly indexed events.