Getting Data In

Why is the SEDCMD not working when ingesting a CSV via the web interface?

eugenek
Path Finder

Using the 7.0.1 web interface to ingest a CSV, and the SEDCMD command is not working. Tried reducing to the simplest possible scenario below.

alt text

0 Karma

eugenek
Path Finder

Upgraded to 7.1.0, and same issue.

0 Karma

micahkemp
Champion

You need a trailing slash (or more specifically, a slash to denote the end of your replacement string and the start of flags):

SEDCMD-test = y/o/O/

From the props.conf SEDCMD section:

substitute - y/string1/string2/
0 Karma

eugenek
Path Finder

Good catch. I was trying to come up with the simplest example possible, and had a typo. However, it still doesn't work (screenshot updated). Does it work for you?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...