Splunk Search

regex: replace my events with _raw=Body

Mohsin123
Path Finder

Hi,

I want to replace my events with _raw=Body
can anyone help ? pl let me know the regex .

Regards
Shraddha

Tags (2)
0 Karma

woodcock
Esteemed Legend

Nobody is going to be able to answer your question or even give you much help unless you provide a great deal more detail, including samples of your existing data and a mockup of your desired final state.

0 Karma

akocak
Contributor

Assuming this is your regex for the field:

 ...|rex "\nBody:\s(?<_raw>[^\}]+)"

then I would do

....| regex field=_raw "\nBody:\s(?<new_raw>[^\}]+)"
| eval _raw=new_raw

please note that pre-extracted fields such as host, _time, sourcetype will still be there. you can always see time of the event even if it doesn't exist in new_raw.

If you want to index from HF on this way, this will require you props.conf and transforms.conf. But that's not the question after all 🙂

0 Karma

493669
Super Champion

can you provide sample events and what is expected output?

0 Karma

493669
Super Champion

it seems previous comments are deleted :
have you tried:

...|rex "\nBody:\s(?<_raw>[^\}]+)"
0 Karma

Mohsin123
Path Finder

I asked you how we can rewrite event at HF level, so that data come only having Body data.

You are giving me query I gave you 😄

0 Karma

p_gurav
Champion

You can use route and filter on HF. Refer below data:
http://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Routeandfilterdatad

If you want to Anonymize you can use SED-CMD
https://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Anonymizedata

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!