Splunk Search
Highlighted

Remove first four lines of field

Explorer

I want to display each event's raw text in a table column, but I need to remove the first four lines of the field (terminalid, operatorid, date, and time lines). Is there a way I can always 'hide' the first four lines of the field before displaying it in a dashboard table at searchtime?

This is what the field looks like:
CA7TERMINALID= data here!

CA7OPERATORID= data here!

CA7DATE= data here!

CA7
TIME= data here!

CA7TRANSACTION= data here!

CA7
JOB= data here!

CA7SYSTEM= data here!

CA7
DESC= data here!

CA7ACTIVESIZE=data here !

CA7PROGRAM= data here!

CA7
MESSAGE= data here!

0 Karma
Highlighted

Re: Remove first four lines of field

Legend

Hi calarie001,
in you dashboard panels do you use table command to define which fields to display or do you display raw data?
In the first case you can choose which fields to display

index=my_index
| table CA7_TIME CA7_TRANSACTION CA7_JOB CA7_SYSTEM CA7_DESC CA7_ACTIVE_SIZE CA7_PROGRAM CA7_MESSAGE

Bye.
Giuseppe

0 Karma
Highlighted

Re: Remove first four lines of field

Champion

If the number of logs is large, it is slow.

(your search)|streamstats count by rec_no
|eval CA7_TERMINAL_ID=if(rec_no<5,"",CA7_TERMINAL_ID)
|eval CA7_OPERATOR_ID=if(rec_no<5,"",CA7_OPERATOR_ID)
|eval CA7_DATE=if(rec_no<5,"",CA7_DATE)
|eval CA7_TIME=if(rec_no<5,"",CA7_TIME)
0 Karma
Highlighted

Re: Remove first four lines of field

Esteemed Legend

It really, really, really, really helps to see you raw events and your search. Because you keep referring to this dataset as a field I am assuming that this is a single event and that you need to strip out that data. This seems unlikely but...

Try this

Your Search Here
| rex field=YourFieldNameHere mode=sed "s/^.*?CA7_TIME=[^\n\r\s]+//"
0 Karma