Im trying to get a way to have SED (via search) append a string to the raw log in the results window if a condition is met anywhere in the raw log file - in the example below if i find any series of six numbers
index=* | rex mode=sed "s/(?<myTest>[0-9]{1,6})/\2<myTestFound>/g
What i would like is the following -and note the "<myTestFound>" at the end
<MyData>"This is my raw log with 123456 present and 987654 also present</MyData><myTestFound>
But all i have been able to do so far is
<MyData>"This is my raw log with 123456<myTestFound> present and 987654<myTestFound> also present</MyData>
Can anyone give me some assistance in getting the first option going? thanks
What do you mean by "end of log"? Splunks returns results from search (and operates on them with streaming commands) one event at a time.
Futrthermore, rex's sed doesn't accept any other modifiers than "g" or a number which means that it won't work in multiline mode. So best you can do with sed-mode is append a string at the end of the line. It's meant for data anonymization rather than some fancy sed-voodoo.
If you only want to append a string to the end of the event, why don't you just do eval appending said string to the _raw field?
| rex mode=sed "s/(?<myTest>[0-9]{1,6}.*)/\1<myTestFound>/g"