I have an so many blanklines , and whitespaces in a single event , Now i want to strip of these blank lines , and mutliple whitespaces ignoring a single whitespace. How can i do this using SEDCMD prop in props.conf
I have tried the following configuration,in props.conf
SEDCMD-parse1 = s/(?m)\n//g s/ *//g
s/(?m)\n//g - to remove blanklines
s/ *//g - to remove mutliple whitespaces
but this doesnt work ? any better idea of doing this pls ?
My sample event :
</ Envelope >
Now i am expecting the following output,
Sry i am unable to post sample event also, it has the above data splitted by lines and whitespaces . any idea on this SEDCMD pls?
This works for me in props.conf:
[foo] SEDCMD-spaces = s/[\n\r]+|\s\s+//g TIME_FORMAT = %d-%b-%y:%H-%M-%S
for turning this:
26-JUL-13:10-23-34 <Envelop e> <sample > Text </sample> </ Envelope >
Note: Depending on your XML, removing all multi-space blocks entirely may damage the XML. For example, if you have this:
<foo bar="baz" />
and remove the double space to get this:
you may be in trouble.
Hi martin, Here is my props setting,
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = true
pulldown_type = 1
SEDCMD-parse1 = s/*//g
SEDCMD-parse2 = s/[\n\r]+|\s\s+//g
I have used above parse s/*//g to remove the special * which is avaiable in my log data along with blank lines and whitespaces ..
Hi Martin..thanks for the update .. but this is working in query.but not working in props.conf..
index="default" sourcetype="mydata" source="/splunkInput/Parsing/parse4.1_2013-07-2616.32.15.log" | rex mode=sed "s/*//g" | rex mode=sed "s/[\n\r]+|\s\s+//g"