Hi there,
I have XML logs that I bring into spunk. Unfortunately, there is far too much not required information for me to go through,
eg, an event will contain,
2 12/12/12 3:53:39.945 PM
I really want to filter it down to
2012.12.12 20:53:39.945 GMT
As you can see, a lot less detail.
Anyone have any ideas - thanks
If you're just doing this because you want to browse through events more easily and don't want to actually lose any data, another route you could take is to extract the XML values to fields (have a look at the xmlkv
and spath
commands), and then use table
to show only the fields in the XML events that you're interested in.
Yep.
You can write a sed filter to alter the event before its indexed.
I assume this is what you want.
DISCLAIMER - the original event is lost for good, you can't get back the data you strip out.
Put this in your props.conf under a stanza that represents this sourcetype/source/whatever
change 'date|hostname|level|message' to be the list of fields you want to keep.
SEDCMD-reduce_xml = s/(?:(?!<record>)<((?!(?:date|hostname|level|message)>)[^>]+)>.*?<\/\1>)|<\/?record>//g
You'll need to restart splunk for the change to take effect