could anyone help use to parsing/trimming of the raw event using heavy forworders?
Plzz find the attached screenshot .i want to ignore the rest of the events except few tags that I was highlighted.
I request you to provide me proper configuration.
See props.conf and SEDCMD.
If you're new to regular expression use regex101.com to help you build the correct regexes.
You will need the SEDCMD in props on the first "heavy" splunk that receives the data.
If the fields are always in the same order, you should be able to do it using
SEDCMD. Add this line to your props.conf file:
SEDCMD-record = s/\<L:RECORD>.*?(\<L:EPOCH>.*?\<\/L:EPOCH>)[\S\s]+(\<L:MESSAGEID>.*?\<\/L:MESSAGEID>)[\S\s]+(\<L:TEXT>.*?\<\/L:TEXT>).*\<\/L:RECORD>/$1$2$3/
As others have said, use
SEDCMD and use capture groups to grab your stuff so it would look something like this:
SEDCMD-reduceraw = s/^firstSkipRegEx(firstCaptureRegEx)secondSkipRegEx(secondCaptureRegEx)thirdSkipRegEx(thirdCaptureRegEx).*$/\1,\2,\3/g