Splunk Search
Highlighted

How should i do SEDCMD filter URL?

Path Finder

I have use Heave Forward and modify props.conf

source:...

SEDCMD-nourl = s/\surl=("\w+"|"\w+\[./\]"|)\s/ /g    

RAW data:
i.g:

url="N/A" -----OK

or

url="/bases/av/kdb/i386/kdb-i386-1211g.xml.dif" ----Fail

or

url="/SimpleAuthWebService/SimpleAuth.asmx" ----- Fail

How should i do?

Thank you!

Tags (1)
0 Karma
Highlighted

Re: How should i do SEDCMD filter URL?

Builder

I'm sorry chengyu, it's not very clear to me what you are asking or what you are trying to achieve.

0 Karma
Highlighted

Re: How should i do SEDCMD filter URL?

Ultra Champion

Could this work? Should remove the string 'url=' and all non-space characters directly following it.

SEDCMD-nourl = s/\surl=\S+/ /g

EDIT: small change to replace url with " " instead of \s.

Hope this helps,

K

View solution in original post

0 Karma
Highlighted

Re: How should i do SEDCMD filter URL?

Path Finder

Thank you kindly support!

0 Karma
Highlighted

Re: How should i do SEDCMD filter URL?

Path Finder

Thank you kindly support!

0 Karma