SEDCMD help

pavanbmishra · ‎12-20-2021

We have below CEF logs coming in from the device where few field doesn't have any value like cs2 below

CEF:0|vendor|product|1.1.0.15361|6099|DirectoryAssetSyncSucceeded|1|cn1label=EventUserId cn1=-3 cs1label=EventUserDisplayName cs1=Automated System cs2label=EventUserDomainName cs2= cn2label=AssetId cn2=16699 cs3label=AssetName cs3=ABC.LOCAL AD cn3label=AssetPartitionId cn3=7 cs4label=AssetPartitionName cs4=XYZ.LOCAL partition cs5label=TaskId cs5=9ec9aa87-61b9-11ec-926f-3123456edt

How can we assign 'NULL' value to such field using SEDCMD or any other possible way here?

richgalloway · ‎12-20-2021

Perhaps this will get you started.

SEDCMD-csNULL = s/(c[sn]\d)=\s+(c[sn]\dlabel)/$1=NULL $2/g

---
If this reply helps you, Karma would be appreciated.

SEDCMD help

field extraction

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Manage Edge Processor pipelines end to end with APIs

Join the Conversation

SEDCMD help

field extraction

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Manage Edge Processor pipelines end to end with APIs