How to replace values of raw events before it getting indexed?

[dsenapaty]

Hello All,

I am kind of new into splunk. Need help to remove "ms" from the below data sets even before this data is being indexed so that i can use tstats command on these values to create faster searches. Could anyone please help with this.

Sample data:

2022-09-11 22:00:59,998 INFO -(Success:true)-(Validation:true)-(GUID:68D74EBE-CE3B-7508-6028-CBE1DFA90F8A)-(REQ_RCVD:2022-09-11T22:00:59.051)-(RES_SENT:2022-09-11T22:00:59.989)-(SIZE:2 KB)-(RespSent_TT:0ms)-(Actual_TT:938ms)-(DB_TT:9ms)-(Total_TT:947ms)-(AppServer_TT:937ms)

How do i remove the string "ms" after all the response times in this data.

[FelixLeh]

These articles could help you:

https://community.splunk.com/t5/Splunk-Search/Masking-data-using-regex-during-Indexing/m-p/319796

https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata