Getting Data In
Highlighted

ignore the raw event using heavy forworder

New Member

Hi ALL,

could anyone help use to parsing/trimming of the raw event using heavy forworders?

Plzz find the attached screenshot .i want to ignore the rest of the events except few tags that I was highlighted.

I request you to provide me proper configuration.

Thanks,
Nerellu alt text

0 Karma
Highlighted

Re: ignore the raw event using heavy forworder

SplunkTrust
SplunkTrust

See props.conf and SEDCMD.

If you're new to regular expression use regex101.com to help you build the correct regexes.

You will need the SEDCMD in props on the first "heavy" splunk that receives the data.

0 Karma
Highlighted

Re: ignore the raw event using heavy forworder

SplunkTrust
SplunkTrust

If the fields are always in the same order, you should be able to do it using SEDCMD. Add this line to your props.conf file:

SEDCMD-record = s/\<L:RECORD>.*?(\<L:EPOCH>.*?\<\/L:EPOCH>)[\S\s]+(\<L:MESSAGEID>.*?\<\/L:MESSAGEID>)[\S\s]+(\<L:TEXT>.*?\<\/L:TEXT>).*\<\/L:RECORD>/$1$2$3/
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: ignore the raw event using heavy forworder

Esteemed Legend

As others have said, use SEDCMD and use capture groups to grab your stuff so it would look something like this:

SEDCMD-reduceraw = s/^firstSkipRegEx(firstCaptureRegEx)secondSkipRegEx(secondCaptureRegEx)thirdSkipRegEx(thirdCaptureRegEx).*$/\1,\2,\3/g
0 Karma