Splunk Search

Multiple SEDCMDs

ephemeric
Contributor

Greetz,

Does anyone know if multiple SEDCMDs are supported at index time in props.conf?

Also, can I implement this search through a regex transform or any other way?

sourcetype="vul:foresight" | rex mode=sed "s/\\\\\\//\\//g" | rex mode=sed "s/\\\n/\n/g" | rex mode=sed "s/<13>.*\.\.\.//g" | rex mode=sed "s/\.\.\..*\n//g" | rex mode=sed "s/^<13>//g"

Thank you.

Tags (3)
1 Solution

ephemeric
Contributor

You can do multiple SEDCMDs for the same sourcetype but not in the same props.conf file I found!

View solution in original post

cpeteman
Contributor

Does anyone have the answer for the second part of his question?

0 Karma

ephemeric
Contributor

You can do multiple SEDCMDs for the same sourcetype but not in the same props.conf file I found!

ephemeric
Contributor

Thank you! Brilliant.

0 Karma

the_wolverine
Champion

Actually you can use multiple SEDCMDs in the same props.conf and for the same sourcetype:

[vul:foresight]
SEDCMD-first = s/\\\//\//g
SEDCMD-second = s/\\n/\n/g
SEDCMD-third = s/<13>.*...//g
etc.

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...