Splunk Search

How to Remove event prefix from JSON using SEDCMD in props.conf?

iamsplunker
Communicator

Hi Splunk community, 

I've JSON logs and I wanted to remove the prefix from the events and capture from {"successfulSetoflog
until AZURE API Health Event"}

Sample Event:

2020-02-10T17:42:41.088Z 775ab4c6-ccc3-600b-9c84-124320628f00 {"records": [{"value": {"successfulSetoflog": [{"awsAccountId": "123456789123", "event": {"arn": "arn:aws:health:us-east-........................................................  1}, "detail-case": "AZURE API Health Event"}}]}

The expected output would be 

{"successfulSetoflog": [{"awsAccountId": "123456789123", "event": {"arn": "arn:aws:health:us-east-........................................................  1}, "detail-case": "AZURE API Health Event"}

Labels (3)
Tags (3)
0 Karma
1 Solution

iamsplunker
Communicator

By applying these settings in props.conf the prefix was removed and events are parsing as expected.

SEDCMD-1=s/^[^\{]+{"records":\s+\[\{"value":\s//

SEDCMD-2=s/}\]\}//

 

View solution in original post

0 Karma

iamsplunker
Communicator

By applying these settings in props.conf the prefix was removed and events are parsing as expected.

SEDCMD-1=s/^[^\{]+{"records":\s+\[\{"value":\s//

SEDCMD-2=s/}\]\}//

 

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...