How to write a regular expression to filter out any data after a second semi-colon per line?

[newbiesplunk]

Hi,

I have a file that contains the following format and I wish to only index information before the 1st two semi-colons and remove the data after the 2nd semi-colon. thks

original files:

abc;3244;19Jul2015 12:32;
ab1;testing 123;19/07/2015 12:32

To be forwarded to indexer:

abc;3244
ab1;testing 123

[martin_mueller · Accepted solution]

Try this in props.conf:

SEDCMD-something = s/^([^;]*;[^;]*).*$/\1/g

Note, if you want to change the event before it's forwarded you will need to use a heavy forwarder.

[martin_mueller]

As in "remember previous events and only send different ones"?

No, as of now Splunk can't do that. You're limited to all the power of regular expressions, which do not have that kind of memory.
However, you can write your searches to deal with potential duplicates / events with no new interesting information.

[newbiesplunk]

Hi,
Not sure if splunk is able to do it, if i want the event to be forwarded to splunk index only when there is changes in the info before the 1st semi-colon? thks