SEDCMD question

[bowesmana]

I want to strip certain characters from my data on input. It changes the _raw data, but not the search time extracted fields. In particular I have a field 'Asset_Title' that I want to change certain chars in, so in props.conf I have

SEDCMD-Asset_Title = s/MP/ZZ/g

So, I see the raw data has all the MP changed to ZZ, but the field, 'Asset_Title' still shows the field with the MP.

I don't understand that and I am also not sure what the part of SEDCMD is supposed to mean - i.e. Asset_Title above - what is the purpose of that?

Also, now search Asset_Title=M* shows the titles starting with M, but search Asset_Title=MP* finds no hits and search Asset_Title=ZZ* also finds no hits. Uh???

[sbrant_splunk]

The part of the name is somewhat arbitrary, it could be anything, it doesn't have to be the field name.

If you want to change only the Asset_Title field in your events, you should do something like this:

SEDCMD-title = s/Asset_Title=(MP)/Asset_Title=ZZ\1/g

The ZZ will replace what's in the capture group (MP in this case). You'll have to adjust the regex to match the values in the Asset_Title field, as I'm sure the above example won't quite do it. If you want to post an example of your data, I can post a more accurate answer.

[sbrant_splunk]

Yes, I think this syntax is probably best then:

SEDCMD- = y///

[bowesmana]

At the bottom is a line of data and what I am actually trying to do is replace any U+2018 or U+2019 chars with a 0x27. The first Field is Asset_Title and contain Tap 'n Print, where the ' is U+2018, so my SEDCMD is

SEDCMD-Asset_Title = s/(‘|’)/'/g

I used MP and ZZ as a proof of concept. I guess I could probably use the y/‘’/''/

Tap 'n Print,_scorm12_sppubknowledgera_o254ao,Custom Asset,username,FirstName,LastName,Vietnam,RVX125,0,2013-05-28,2013-07-22,41,0,,2013-07-22,Completed,,90.00,90.00,20,1670,Direct sales