hey everyone,
Our server here generates a filestamp/header at midnight or on resets that start with a line of dashes(----), then enters a line of system and log information (this is useful), then ends with another line of dashes (----). I've been trying to use SEDCMD to delete the dashed lines (including the carriage return) but it doesnt seem to be working.
SEDCMD-StripBreaks = s/\n?----*//g
I've tried changing the name for the class, tried removing the "\n", double escaping the "\n", all of it just doesn't work. One thing that works is if I try it inline..
| rex mode=sed "s/\n?----*//g"
I could use some help getting my head around this..
Update:
so I've tried to do this with a different issue I'm having which is repeated spaces, if I use the rex sed mode it works just fine, but the second i add it to props it falls apart. here's the second one I've tried..
SEDCMD-SubSpaces = s/\s\s+/ /g
beside this i've tried changing how the SED is applied by giving it a source file instead of the sourcetype and it still doesnt work. here is the working rex for my second SEDCMD.
rex mode=sed "s/\s\s+/ /g"
again, any help is appreciated!
... View more