Trim off a trailing comma before the end of an event, SEDCMD?

[evan_scheessele]

I have a set of events, each a JSON object, separated from each other as one-per-line (SHOULD_LINEMERGE = false), but each of the JSON objects ends its line of text with a trailing comma:

...}},

How do I use a SEDCMD to trim off that comma? Just this?

SEDCMD-remove-trailing-json-comma = s/,$/

...or do I need to match the line-feed at the end of each event too?

NOTE: I'm assuming I should put this SEDCMD into my props.conf on my Splunk heavy-forwarder, one-hop upstream from my core-indexer. Any advice is welcome. The above SEDCMD doesn't seem to work.

From the logs:

splunkd.log.2:03-30-2013 00:02:07.330 +0000 ERROR regexExtractionProcessor - Error while parsing sed name="SEDCMD-remove-trailing-json-comma", string="s/,$/", errMsg="Failed to initialize sed. Failed to parse the replacement string."

[ShaneNewman · Accepted solution]

Try SEDCMD-remove-trailing-json-comma = s/\,$//

[evan_scheessele]

Thanks - this ended up working for me, very similar. Yeah, I missed that final /

SEDCMD-remove-trailing-json-comma = s/,$//

[dwaddle]

I updated your syntax slightly. SEDCMD (like its sed great-grandfather) looks for a "find" and a "replace" which are (by convention) separated by the / character. So, to remove a trailing comma, you need to have the "replace" be an empty string.