Splunk Search

How to Remove event prefix from JSON using SEDCMD in props.conf?

iamsplunker
Communicator

Hi Splunk community, 

I've JSON logs and I wanted to remove the prefix from the events and capture from {"successfulSetoflog
until AZURE API Health Event"}

Sample Event:

2020-02-10T17:42:41.088Z 775ab4c6-ccc3-600b-9c84-124320628f00 {"records": [{"value": {"successfulSetoflog": [{"awsAccountId": "123456789123", "event": {"arn": "arn:aws:health:us-east-........................................................  1}, "detail-case": "AZURE API Health Event"}}]}

The expected output would be 

{"successfulSetoflog": [{"awsAccountId": "123456789123", "event": {"arn": "arn:aws:health:us-east-........................................................  1}, "detail-case": "AZURE API Health Event"}

Labels (3)
Tags (3)
0 Karma
1 Solution

iamsplunker
Communicator

By applying these settings in props.conf the prefix was removed and events are parsing as expected.

SEDCMD-1=s/^[^\{]+{"records":\s+\[\{"value":\s//

SEDCMD-2=s/}\]\}//

 

View solution in original post

0 Karma

iamsplunker
Communicator

By applying these settings in props.conf the prefix was removed and events are parsing as expected.

SEDCMD-1=s/^[^\{]+{"records":\s+\[\{"value":\s//

SEDCMD-2=s/}\]\}//

 

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...