Getting Data In

SEDCMD pattern replacement not working

Path Finder

My props.conf is as follows. The SEDCMDs seem to be very temperamental

[server]
MAX_TIMESTAMP_LOOKAHEAD = 0
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3},
TIME_FORMAT = %Y-%m-%d %H:%M:%S
SEDCMD-exception-raised-ignore = s/(Exception raised [^:]*:).*$/\1 INFO REMOVED)/g
SEDCMD-remove-extra-timestamp = s/(ERROR \[STDERR\]) \d{2}-\w{3}-\d{4} \d{2}:\d{2}:\d{2}/\1 DATE REMOVED/g
REPORT-server = jboss-server-extractions

And then I get (some values changed)

2011-02-16 16:11:24,336, ERROR [STDERR] com.company.Exception: attempt to retrieve money as wrong currency.
    (Exception raised at address: server8.production/10.0.0.8); 
    (Exception raised on date: INFO REMOVED)

So the SEDCMD-exception-raised-ignore is working on the second 'Exception raised' line but not the first. Earlier today I was struggling to get it to work at all, and even now, other very similar results aren't being processed:

2011-02-16 17:23:35,882, ERROR [org.apache.catalina.core.ContainerBase.[jboss.web].[localhost].[/].[zzzaction]] Servlet.service() for servlet zzzaction threw exception
com.company.Exception: com.company.Exception: attempt to retrieve money as wrong currency.  
    (Exception raised at address: server3.production/10.0.0.3); 
    (Exception raised on date: Wed Feb 16 17:23:35 UTC 2011);; 
    (Exception raised at address: server3.production/10.0.0.3); 
    (Exception raised on date: Wed Feb 16 17:23:35 UTC 2011);

Any help in getting to the bottom of why this is so temperamental and how to make it work more regularly would be gratefully received!

Thanks!

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

I haven't run into any issue with SEDCMD. Your RegEx for SEDCMD-exception-raised-ignore will not work correctly. Try it like this:

SEDCMD-exception-raised-ignore = s/(Exception raised [^:]*:)\V*/\1 INFO REMOVED)/g

View solution in original post

Splunk Employee
Splunk Employee

I haven't run into any issue with SEDCMD. Your RegEx for SEDCMD-exception-raised-ignore will not work correctly. Try it like this:

SEDCMD-exception-raised-ignore = s/(Exception raised [^:]*:)\V*/\1 INFO REMOVED)/g

View solution in original post

Path Finder

Just checked the resultset now and it works a treat

0 Karma

Path Finder

Ok, so that's because the SEDCMD is run against the event, not the line? I've given the \V a try and will see how it performs next time the event occurs.

Thanks for the answer, and good to know that SEDCMD is usually reliable!

0 Karma

Splunk Employee
Splunk Employee

Note: This will only affect new data being indexed. Restart Splunk after making the change.

Splunk Employee
Splunk Employee

This makes me wonder about sedcmd with repeat match behavior, and multiline events. Hopefully will come back with something useful later.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!