How to remove commas from a field before indexing?

[jasongori]

I have data that looks like this:

[2014-09-03T00:58:59.977-04:00] [octetstring] [NOTIFICATION] [OVD-20039] [com.octetstring.accesslog] [tid: 71] [ecid: 0000KWtsKqE4Iv8pVgx0ic1K1OL_000zrT,0] conn=150,801 op=0 RESULT err=0 tag=0 nentries=0 etime={3}

[2014-09-03T00:58:59.968-04:00] [octetstring] [WARNING] [] [com.octetstring.vde.backend.jndi.P-AD-INTERNAL-DMN-1.HeartBeatThread] [tid: 19] [ecid: 0000KWpedrsAXNzps0c9yX1K1Oji000005,0] Received exception javax.naming.CommunicationException: XXXX [Root exception is java.lang.NullPointerException]

[2014-09-03T00:58:59.936-04:00] [octetstring] [NOTIFICATION] [OVD-20071] [com.octetstring.accesslog] [tid: 28391] [ecid: 0000KWtpDSGAXNzps0XBiX1K1OmZ001T3R,0] conn=206,433 op=2 fd=0 closed - U1

In this data the conn values are actually connection ids. I need them to come in without the comma. How can I remove the comma pre-index? I'm assuming there's a way to transform it I've just never done so.

[MarioM]

you could use SED in your props.conf, it s index time parameter thus will only apply to new data and need splunk restart:

SEDCMD-<class> = <sed script>
* Only used at index time.
* Commonly used to anonymize incoming data at index time, such as credit card or social
  security numbers. For more information, search the online documentation for "anonymize
  data."
* Used to specify a sed script which Splunk applies to the _raw field.
* A sed script is a space-separated list of sed commands. Currently the following subset of
  sed commands is supported:
        * replace (s) and character substitution (y).
* Syntax:
        * replace - s/regex/replacement/flags
                * regex is a perl regular expression (optionally containing capturing groups).
                * replacement is a string to replace the regex match. Use \n for backreferences,
                  where "n" is a single digit.
                * flags can be either: g to replace all matches, or a number to replace a specified
                  match.
        * substitute - y/string1/string2/
                * substitutes the string1[i] with string2[i]