Character-Set replacement during indexing

[strive]

Hi,

I want to replace a set of characters during indexing.

Say, My one log event in my log file is:

2012-05-08 12:02:06 "/core/hd_3pg/4.0" 127.0.0.1 a=4.5&c=NA&cl=false&d=SGH-T989&f=2.3.6_GINGERBREAD&l=INFO&log=7&v=log4j&p=android*%0D10%*0A3.1.85&time=1336478520

I will index full entry as-is in summary index. While indexing i would like to replace % of %0D as %25. % of %0A should be unaffected. So, the final entry inside summary index should be

2012-05-08 12:02:06 "/core/hd_3pg/4.0" 127.0.0.1 a=4.5&c=NA&cl=false&d=SGH-T989&f=2.3.6_GINGERBREAD&l=INFO&log=7&v=log4j&p=android*%25*0D10%0A3.1.85&time=1336478520

Thanks
Strive

[kristian_kolb · Accepted solution]

I guess that you could create a sed script in props.conf

[your sourcetype]
SEDCMD-percent_replace = s/%0D/%250D/g

See more information here:
http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Anonymizedatausingconfigurationfiles

Hope this helps,

Kristian

[strive]

Hi Kristian,
Thanks a lot.
This really helps me. I need to replace three sets of characters. Some sets i should replace with empty strings.

[your sourcetype]
SEDCMD-percent_replace = s/%0D/%250D/g s/%0A/ /g s/%0B%0C/ /g

Thanks
Strive