Hi ,
I am having json logs which I on-boarded to Splunk
{"body":{"records": {"time": "2020-12-20T13:28:50.2164144Z","MachineGroup": "Windows 10", "Timestamp": "2020-12-20T13:27:18.6679858Z", "DeviceName": "3242d4e4.dc.democorp.com", "ReportId": 306737}}},"x-opt-sequence-number":159959006,"x-opt-offset":"2713650553292728","x-opt-enqueued-time":1624195823422}
I am trying to remove everything after "}}}" with SEDCMD and my props.conf is below-mentioned
[json_log]
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
category = Custom
disabled = false
INDEXED_EXTRACTIONS = json
KV_MODE = none
DATETIME_CONFIG = CURRENT
TRUNCATE = 0
SEDCMD-unwantedfields=s/\}\}\}(.*)/g
Fields are not in raw logs, however when expending details can see the field values
Any suggestion, what I am doing wrong ?
https://regex101.com/r/btYSah/1
Thanks @kamlesh
Minor changes, resulted in required result.
SEDCMD-unwantedfields=s/\}\}\}(.*)\}/g
Can you please try this?
[json_log]
SHOULD_LINEMERGE=true
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
SEDCMD-unwantedfields=s/\}\}\}(.*)/}}}/g
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
Thanks @kamlesh
Minor changes, resulted in required result.
SEDCMD-unwantedfields=s/\}\}\}(.*)\}/g