- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Splunk community,
I've JSON logs and I wanted to remove the prefix from the events and capture from {"successfulSetoflog
until AZURE API Health Event"}
Sample Event:
2020-02-10T17:42:41.088Z 775ab4c6-ccc3-600b-9c84-124320628f00 {"records": [{"value": {"successfulSetoflog": [{"awsAccountId": "123456789123", "event": {"arn": "arn:aws:health:us-east-........................................................ 1}, "detail-case": "AZURE API Health Event"}}]}
The expected output would be
{"successfulSetoflog": [{"awsAccountId": "123456789123", "event": {"arn": "arn:aws:health:us-east-........................................................ 1}, "detail-case": "AZURE API Health Event"}
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
By applying these settings in props.conf the prefix was removed and events are parsing as expected.
SEDCMD-1=s/^[^\{]+{"records":\s+\[\{"value":\s//
SEDCMD-2=s/}\]\}//
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
By applying these settings in props.conf the prefix was removed and events are parsing as expected.
SEDCMD-1=s/^[^\{]+{"records":\s+\[\{"value":\s//
SEDCMD-2=s/}\]\}//
![](/skins/images/89D5ADE867CBAF0B5A525B7E23D83D7E/responsive_peak/images/icon_anonymous_message.png)