How can I keep only first 6k bytes of single line event by transforms.conf

[Masa]

How can I keep only first 6k bytes of single line event.

I have syslog type of data. They are single line and sometimes more than 64k Byte long.
But, I need only first 6k bytes of an event.
So, I created the following transforms.conf. But, it does not work.
I know SEDCMD works to do the same job.
But, why does transforms.conf not work?

• props.conf

  [syslog-cef]
  SHOULD_LINEMERGE = false
  TRANSFORMS-keep6k = keep6k

• transforms.conf

  [keep6k]
  REGEX = ^(.{6144})
  DEST_KEY = _raw
  FORMAT = $1
  Data is not truncated to 6k.

[MuS · Accepted solution]

Hi Masa,

take a look at this answer http://answers.splunk.com/answers/306418/how-can-i-remove-partial-string-of-single-line-eve-1.html#a... 🙂

cheers, MuS

[Masa]

Thanks, MuS.

[woodcock]

It is easier to use SEDCMD like this:

props.conf

[syslog-cef]
SEDCMD-keepFirst6k = s/^(.{0,6144}).*/\1/

[woodcock]

Your initial solution looks fine to me; did you restart all Splunk instances on your Indexers and Heavy Forwarders?

[Masa]

Hi, woodcok. Thanks you for your advice. Yes, I did restarted. In my test, I used a UF and indexer. But, it is same result even if I have a standalone instance to monitor the same file.

[Masa]

Thanks for quick response.
If I used SEDCMD with the following regex. This works.

SEDCMD-keepFirst6k = s/^(.{6144})/\1/

I'm looking for transforms.conf so that I can use the same regex for multiple sourcetypes by calling this transform name.

[woodcock]

IMHO, you are gaining nothing except in the case that you decide to change from 6144 character to some other number (in that case you would have to edit every props.conf copy). If you are not planning on doing this, then the SEDCMD solution is shorter, better, and has every other benefit.