Getting Data In

Why is the SEDCMD not working when ingesting a CSV via the web interface?

eugenek
Path Finder

Using the 7.0.1 web interface to ingest a CSV, and the SEDCMD command is not working. Tried reducing to the simplest possible scenario below.

alt text

0 Karma

eugenek
Path Finder

Upgraded to 7.1.0, and same issue.

0 Karma

micahkemp
Champion

You need a trailing slash (or more specifically, a slash to denote the end of your replacement string and the start of flags):

SEDCMD-test = y/o/O/

From the props.conf SEDCMD section:

substitute - y/string1/string2/
0 Karma

eugenek
Path Finder

Good catch. I was trying to come up with the simplest example possible, and had a typo. However, it still doesn't work (screenshot updated). Does it work for you?

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Word Search

This challenge was first posted on Slack #puzzles channelThis puzzle is based on a letter grid containing ...

[Puzzles] Solve, Learn, Repeat: Advent of Code - Day 4

Advent of CodeIn order to participate in these challenges, you will need to register with the Advent of Code ...

GA: S3 Promote for Historical Data Ingestion in Splunk Cloud

Ingest Historical S3 Data On-Demand: Announcing the General Availability of S3 Promote We’re excited to share ...