Getting Data In

ignore the raw event using heavy forworder

nerelluk
New Member

Hi ALL,

could anyone help use to parsing/trimming of the raw event using heavy forworders?

Plzz find the attached screenshot .i want to ignore the rest of the events except few tags that I was highlighted.

I request you to provide me proper configuration.

Thanks,
Nerellu alt text

0 Karma

woodcock
Esteemed Legend

As others have said, use SEDCMD and use capture groups to grab your stuff so it would look something like this:

SEDCMD-reduceraw = s/^firstSkipRegEx(firstCaptureRegEx)secondSkipRegEx(secondCaptureRegEx)thirdSkipRegEx(thirdCaptureRegEx).*$/\1,\2,\3/g
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the fields are always in the same order, you should be able to do it using SEDCMD. Add this line to your props.conf file:

SEDCMD-record = s/\<L:RECORD>.*?(\<L:EPOCH>.*?\<\/L:EPOCH>)[\S\s]+(\<L:MESSAGEID>.*?\<\/L:MESSAGEID>)[\S\s]+(\<L:TEXT>.*?\<\/L:TEXT>).*\<\/L:RECORD>/$1$2$3/
---
If this reply helps you, Karma would be appreciated.
0 Karma

jkat54
SplunkTrust
SplunkTrust

See props.conf and SEDCMD.

If you're new to regular expression use regex101.com to help you build the correct regexes.

You will need the SEDCMD in props on the first "heavy" splunk that receives the data.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...