ignore the raw event using heavy forworder

[nerelluk]

Hi ALL,

could anyone help use to parsing/trimming of the raw event using heavy forworders?

Plzz find the attached screenshot .i want to ignore the rest of the events except few tags that I was highlighted.

I request you to provide me proper configuration.

Thanks,
Nerellu

[woodcock]

As others have said, use SEDCMD and use capture groups to grab your stuff so it would look something like this:

SEDCMD-reduceraw = s/^firstSkipRegEx(firstCaptureRegEx)secondSkipRegEx(secondCaptureRegEx)thirdSkipRegEx(thirdCaptureRegEx).*$/\1,\2,\3/g

[richgalloway]

If the fields are always in the same order, you should be able to do it using SEDCMD. Add this line to your props.conf file:

SEDCMD-record = s/\<L:RECORD>.*?(\<L:EPOCH>.*?\<\/L:EPOCH>)[\S\s]+(\<L:MESSAGEID>.*?\<\/L:MESSAGEID>)[\S\s]+(\<L:TEXT>.*?\<\/L:TEXT>).*\<\/L:RECORD>/$1$2$3/

[jkat54]

See props.conf and SEDCMD.

If you're new to regular expression use regex101.com to help you build the correct regexes.

You will need the SEDCMD in props on the first "heavy" splunk that receives the data.