Splunk Search

Multiple SEDCMDs

ephemeric
Contributor

Greetz,

Does anyone know if multiple SEDCMDs are supported at index time in props.conf?

Also, can I implement this search through a regex transform or any other way?

sourcetype="vul:foresight" | rex mode=sed "s/\\\\\\//\\//g" | rex mode=sed "s/\\\n/\n/g" | rex mode=sed "s/<13>.*\.\.\.//g" | rex mode=sed "s/\.\.\..*\n//g" | rex mode=sed "s/^<13>//g"

Thank you.

Tags (3)
1 Solution

ephemeric
Contributor

You can do multiple SEDCMDs for the same sourcetype but not in the same props.conf file I found!

View solution in original post

cpeteman
Contributor

Does anyone have the answer for the second part of his question?

0 Karma

ephemeric
Contributor

You can do multiple SEDCMDs for the same sourcetype but not in the same props.conf file I found!

ephemeric
Contributor

Thank you! Brilliant.

0 Karma

the_wolverine
Champion

Actually you can use multiple SEDCMDs in the same props.conf and for the same sourcetype:

[vul:foresight]
SEDCMD-first = s/\\\//\//g
SEDCMD-second = s/\\n/\n/g
SEDCMD-third = s/<13>.*...//g
etc.

Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...