Splunk Search

How do I edit my "rex mode=sed" search to extract this field?

daniel333
Builder

Just playing with rex sed a bit here. I had load balancer log which pops out the data center name. Just thought I would SED the event so that it was in key value format, but it doesn't look like Splunk will extract it as a field. Is there an option I am missing or this normal?

tag=mystuff | rex mode=sed "s/MYDCname/datacenter=MYDCname /g"
0 Karma

chimell
Motivator

Hi
just escape = character like below

tag=mystuff | rex mode=sed "s/MYDCname/datacenter\=MYDCname /g"

verify that MYDCname string is present in a _raw field

0 Karma

woodcock
Esteemed Legend

If you are trying to modify it BEFORE it gets indexed, you need to put a SEDCMD in a props.conf on your HF or Indexers:
http://docs.splunk.com/Documentation/Splunk/6.2.8/Data/Anonymizedatausingconfigurationfiles

0 Karma

somesoni2
Revered Legend

Providing a sample events and highlighting the value you need to extract as a field will help here. The rex with sed is just to update an existing field value. To create/extract a new field, use regular rex, something like this

tag=mystuff | rex field=yourfield(default is _raw) "(?<datacenter>MYDCname)" 
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...