Getting Data In

json SED problem

General_Talos
Path Finder

Hi ,

I am having json logs which I on-boarded to Splunk

 

{"body":{"records": {"time": "2020-12-20T13:28:50.2164144Z","MachineGroup": "Windows 10", "Timestamp": "2020-12-20T13:27:18.6679858Z", "DeviceName": "3242d4e4.dc.democorp.com", "ReportId": 306737}}},"x-opt-sequence-number":159959006,"x-opt-offset":"2713650553292728","x-opt-enqueued-time":1624195823422}

 

I am trying to remove everything after "}}}" with SEDCMD and my props.conf is below-mentioned

 

[json_log]
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
category = Custom
disabled = false
INDEXED_EXTRACTIONS = json
KV_MODE = none
DATETIME_CONFIG = CURRENT
TRUNCATE = 0
SEDCMD-unwantedfields=s/\}\}\}(.*)/g

 

Fields are not in raw logs, however when expending details can see the field values

General_Talos_0-1625487024842.png

Any suggestion, what I am doing wrong ?

https://regex101.com/r/btYSah/1

General_Talos_0-1625487274300.png

 

Labels (2)
0 Karma
1 Solution

General_Talos
Path Finder

Thanks @kamlesh

Minor changes, resulted in required result.

SEDCMD-unwantedfields=s/\}\}\}(.*)\}/g

 

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@General_Talos 

Can you please try this?

[json_log]
SHOULD_LINEMERGE=true
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
SEDCMD-unwantedfields=s/\}\}\}(.*)/}}}/g

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

General_Talos
Path Finder

Thanks @kamlesh

Minor changes, resulted in required result.

SEDCMD-unwantedfields=s/\}\}\}(.*)\}/g

 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...