Getting Data In

remove prefix on every events using SEDCMD

roopeshetty
Path Finder

Hi Guys

 

We are getting logs through syslog with its priority / facility data “ <14>1” prepended with every events as below;

 

 

<14>1 2024-01-18T13:45:06.621+0000 756565656565701b-cd27-475e-bab4-3e0e0893d273

<14>1 2024-01-18T13:39:47.014+0000 565gt5t54t-cd27-475e-bab4-565656565gh

 

roopeshetty_1-1705586279086.jpeg

 

 

We are trying to remove this prefix texts “<14>1” using SEDCMD  on props.conf as below;

 

[source::tcp:7514]

SEDCMD-strip-tcp-priority=s/^<\d+>//

 

This is doing almost very close help by removing “<14>” but still “1” is coming up in events. Can some one please help us how to remove this prefix “ <14>1” on every events using SEDCMD ?

 

 

Regards.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
SEDCMD-strip-tcp-priority=s/^<\d+>\d//

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
SEDCMD-strip-tcp-priority=s/^<\d+>\d//
0 Karma

roopeshetty
Path Finder

Hi ITWhisperer,

 

Thanks, its almost done, but i see a space (gap) before the timestamp, how can we delete this space?

roopeshetty_1-1705587291332.png

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
SEDCMD-strip-tcp-priority=s/^<\d+>\d\s//

PickleRick
SplunkTrust
SplunkTrust

If you need to tweak your regexes, that's a great interactive tool to test them.

https://regex101.com/

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...