I am attempting to test a SEDCMD for event manipulation and it does not appear this is possible via oneshot?
When I try to test SEDCMD in my props.conf it never appears to work.
props.conf
[testst]
SEDCMD-xml = s/"xml":/"chicken":/
my command line attempt to test it
$./splunk add oneshot test.json -sourcetype testst -index mytest
my test event
{ "xml":"<Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:awsse=\"http://xml.chicken.com/2010/06/Session_v3\" xmlns:wsa=\"http://www.w3.org/2005/08/addressing\"><Header><To>http://www.w3.org/2005/08/addressing/anonymous</To><From><Address>..... AND SO ON BIG GIANT NASTEY XML",
"other3":"even more stuff"}
proof this sed works on the command line
$ cat fakeevent.json | sed -e 's/"xml":/"chicken":/'
{ "chicken":"<Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:awsse=\"http://xml.chicken.com/2010/06/Session_v3\" xmlns:wsa=\"http://www.w3.org/2005/08/addressing\"><Header><To>http://www.w3.org/2005/08/addressing/anonymous</To><From><Address>..... AND SO ON BIG GIANT NASTEY XML", "other3":"even more stuff"}
Ah - I forgot to restart. All is well. oneshot will test sourcetype SEDCMD lines in props.conf IF you remember to restart.
Ah - I forgot to restart. All is well. oneshot will test sourcetype SEDCMD lines in props.conf IF you remember to restart.