Getting Data In

Remove syslog prefix from Json

vbotnari1
Engager

I have a Json log which looks like this

Jul 11 14:37:48 darktrace-dt-722-01 darktrace {"creationTime":1562855937000,"breachUrl":...}

I have to remove the timestamp hostanem, all syslog prefixes until {

This is how my props.conf looks like

[darktrace]
SEDCMD-StripHeader = ^([^\{]+) 
KV_MODE = json
pulldown_type = true
category = Structured
description = darktrace

But it doesn't work. I tried INDEXED_EXTRACTIONS = json as well without success.

Any help is appreciated. Thanks

0 Karma
1 Solution

woodcock
Esteemed Legend

It must be an actual sed command like this:

 SEDCMD-StripHeader = s/^[^\{]+//

View solution in original post

woodcock
Esteemed Legend

It must be an actual sed command like this:

 SEDCMD-StripHeader = s/^[^\{]+//

vbotnari1
Engager

Thank you @woodcock . I tried your suggested sed command but it did nothing.

0 Karma

woodcock
Esteemed Legend

If you are doing a sourcetype override/overwrite, you must use the ORIGINAL value NOT the new value, then you must deploy this to the first full instance(s) of Splunk that handles the events (usually either the HF-tier, if you use this, or your Indexer tier), restart all Splunk instances there, send in new events (old events will stay broken), then test using _index_earliest=-5m to be absolutely certain that you are only examining the newly indexed events.

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...