The jist of the search is that it removes lots of infomation from _raw and gives me back whats left AS msgdigest. index=auth |rex mode=sed "s/[a-z]+\d{1,4}//" |rex mode=sed "s/user\s[a-z]+/user /" |rex mode=sed "s/(user|USER)=[a-z]+/user=/" |rex mode=sed "s/\d+//g" |rex mode=sed "s/(Jan|January|Feb|Febuary|Mar|March|Apr|April|May|Jun|June|Jul|July|Aug|August|Sep|September|Oct|October|Nov|November|Dec|December|Mon|Tue|Wed|Thu|Fri|Sat|Sun|PM|AM|PDT|PST)//g" |rex mode=sed "s/\s+/_/g"| rename _raw AS msgdigest |stats count by msgdigest I want to find a way to make this work in prop.conf (or if I have to also using transforms.conf). Appreciate the help!!!! ... View more

I want to remove a string from _raw that appears as a field in Splunk say host. For example if I have the _raw message: <ConMan> Console [hype33] log at 2013-08-15 00:00:00 PDT. 2013-08-15 14:25:48 Setting hostname hype362: [ OK ] The following search gets rid of date, time and any digits in _raw |rex mode=sed "s/\d{1,}//g" |rex mode=sed "s/(Jan|January|Feb|Febuary|Mar|March|Apr|April|May|Jun|June|Jul|July|Aug|August|Sep|September|Oct|October|Nov|November|Dec|December|Mon|Tue|Wed|Thu|Fri|Sat|Sun)//g" | rename _raw AS msgdigest So the msgdigest then becomes: <ConMan> Console [hype] log at -- :: PDT. -- :: Setting hostname hype: [ OK ] As my _raw message and say hype is a type of host I want to have <ConMan> Console [] log at -- :: PDT. -- :: Setting hostname: [ OK ] The final goal here is to create a digest of _raw that has more detail than punct as I find that sometimes errors that are not actually similar have the same punct. So I am making hybrid of _raw and punct so to speak. I may try to make this available as an app in the long run. ... View more