Regex in transform.conf delete text in the middle

[Alwiinie]

I'm having some trouble to delete the text in "plugin_set".

Sample Incoming data:

 {"plugin_family": "somestuff", "policy": "somsestuff2", "plugin_set": "10026;10111;10150;10170;10183;", "pokemon": "somsestuff3"}

Sample what I want:

 {"plugin_family": "somestuff", "policy": "somsestuff2", "plugin_set": "", "pokemon": "somsestuff3"}

This the closest that I got:

REGEX = (.*)("plugin_set".*\,)
DEST_KEY = _raw
FORMAT = $1 nullQueue

I also tried this, but that showed everything.

REGEX = (.*)("plugin_set".*\,)(.*)
DEST_KEY = _raw
FORMAT = $1 nullQueue $3

What is the right regex string for deleting the text in "plugin_set"?

[somesoni2]

Try this in transforms.conf at indexer/heavy forwarder (assuming you're taking care of props.conf changes already)

REGEX = ^(.+\"plugin_set\"\:\s*\")([^\"]+)(\".+)
DEST_KEY = _raw
FORMAT = $1$3

[Alwiinie]

It doesn't work this also showed everything. I don't know if need to change the props.conf more then I now have.
This what I currently have:
tansform.conf:
[removepluginset]
REGEX = ^(.+\"plugin_set\":\s*\")([^\"]+)(\".+)
DEST_KEY = _raw
FORMAT = $1$3

props.conf
[host::hostname]
TRANSFORMS-set = removepluginset

[richgalloway]

Try this.

REGEX = (.*"plugin_set":\s")([^,]+)(",.*)
DEST_KEY = _raw
FORMAT = $1$3

[Alwiinie]

It doesn't work, it just shows the all the data.

Btw in the props.conf I use this

TRANSFORMS-set = removepluginset

[richgalloway]

Are you restarting Splunk after each change to the config files?

[Alwiinie]

Yes, after every change in transform.conf I restart Splunk.