Getting Data In

json SED problem

General_Talos
Path Finder

Hi ,

I am having json logs which I on-boarded to Splunk

 

{"body":{"records": {"time": "2020-12-20T13:28:50.2164144Z","MachineGroup": "Windows 10", "Timestamp": "2020-12-20T13:27:18.6679858Z", "DeviceName": "3242d4e4.dc.democorp.com", "ReportId": 306737}}},"x-opt-sequence-number":159959006,"x-opt-offset":"2713650553292728","x-opt-enqueued-time":1624195823422}

 

I am trying to remove everything after "}}}" with SEDCMD and my props.conf is below-mentioned

 

[json_log]
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
category = Custom
disabled = false
INDEXED_EXTRACTIONS = json
KV_MODE = none
DATETIME_CONFIG = CURRENT
TRUNCATE = 0
SEDCMD-unwantedfields=s/\}\}\}(.*)/g

 

Fields are not in raw logs, however when expending details can see the field values

General_Talos_0-1625487024842.png

Any suggestion, what I am doing wrong ?

https://regex101.com/r/btYSah/1

General_Talos_0-1625487274300.png

 

Labels (2)
0 Karma
1 Solution

General_Talos
Path Finder

Thanks @kamlesh

Minor changes, resulted in required result.

SEDCMD-unwantedfields=s/\}\}\}(.*)\}/g

 

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@General_Talos 

Can you please try this?

[json_log]
SHOULD_LINEMERGE=true
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
SEDCMD-unwantedfields=s/\}\}\}(.*)/}}}/g

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

General_Talos
Path Finder

Thanks @kamlesh

Minor changes, resulted in required result.

SEDCMD-unwantedfields=s/\}\}\}(.*)\}/g

 

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...