Getting Data In

issues with SEDCMD

rusty009
Path Finder

I have the below file being indexed in spunk,

{
    "records": 
    [

        { <event}}

and I would like to get rid of everything before {

so I'm executing the SEDCMD like below,

SEDCMD-StripHeader = s/{\s+\"records\":\s+\[\s+{/{/1

but it doesn't seem to be working. When I test it using the below splunk command it works a treat,

sourcetype="json:blob" | rex field=_raw mode=sed "s/{\s+\"records\":\s+\[\s+{/{/1"

I have restarted splunk, it's running on a single instance ( so this is my search head and indexer) - any ideas what I'm doing wrong?

0 Karma

somesoni2
Revered Legend

Try with this

SEDCMD-StripHeader = s/^(\{\s+\"records\":\s+\[\s+)//

REGEX 101 link to see the regular exp working https://regex101.com/r/zkIXVa/1

Please note that SEDCMD is an index-time operation and would only affect any new event that come after you've configured it. Any existing event will not modified.

0 Karma

nawazns5038
Builder

which is the best instance to add SEDCMD ??

Is it heavy forwarder or indexer ?

0 Karma

rusty009
Path Finder

that doesn't work unfortunately, is there an issue with my props.conf ?

0 Karma

somesoni2
Revered Legend

The regex of your's works too. I guess if you've a copy of the file that you're monitoring available locally, you can test the SEDCMD command from Add data wizard. (Settings-> Add data -> Upload, go to advanced tab of left side bar and add SEDCMD of your).

0 Karma
Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

&#x1f48c;Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...