Splunk Search

how to skip a fixed number of characters after a conditional keyword

splunksogetiht
Explorer

I have a log that looks like that :

create message w-OtYwP8QD2WcAkmUgZEgg from DB and add it in the map.
create message cbB8MZnaRYmt1elBWW2i3w from DB and add it in the map.
Message 'P2S2mMJSTVSMO0OjrHh4Kw' was set to pause.
adding new message F6252jqPRbq6iaBLyiC6cw in Map - appli source = ASLC
ABDC parameter event received : parameter name = 'ACID', value = '---'.

I would like to skip the 22 characters that follow the keyword “message”. But that keyword is not present on all lines.
How shall I do that ?
Thank you
,

Tags (2)
0 Karma

OL
Communicator

Have you check the Splunk documentation: http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Anonymizedatausingconfigurationfiles . Did this help? If not, let us know why.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...