About kritho

kritho · ‎06-20-2017

Yes, I just tried the setting, and theres no change. (still stripping leading/trailing Spaces after setting KV_TRIM_SPACES to true) k

yannK · ‎06-09-2017

Not really, the sedcmd applied to all data matching the stanza, and the stanza in props can only apply to : an exact sourcetype, or a source or a host. There is not way to apply to a specific index. You can try the host. example with props.conf [host::*mydevhost*] SEDCMD-remove-values = s/<Value>.+<\/Value>/removed-by-splunk/g

kritho · ‎01-22-2016

Excellent. This works! tx

kristian_kolb · ‎05-16-2013

To do that inline in the search, you can use rex in the example below, look at the fourth element of the path (i.e. source); your search | rex field=source "/([^/]+/){3}(?<username>[^/]+)" /K

Ayn · ‎10-25-2012

That is based on the locale used by the browser accessing Splunkweb. http://splunk-base.splunk.com/answers/525/how-can-i-change-the-time-format-in-splunk-web

Posts	8
Solutions	0
Karma Given	4
Karma Received	1
Member Since	‎05-08-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

In a field extraction, why does Splunk remove lead...

sedcmd incoming data based on host or index

How to search transactions across different hosts ...

extract username for element in path

Timeformat display

Re: In a field extraction, why does Splunk remove ...

Re: sedcmd incoming data based on host or index

Re: How to search transactions across different ho...

Re: extract username for element in path

Re: Timeformat display

Join the Conversation