Hi,
I have a file that contains the following format and I wish to only index information before the 1st two semi-colons and remove the data after the 2nd semi-colon. thks
original files:
abc;3244;19Jul2015 12:32;
ab1;testing 123;19/07/2015 12:32
To be forwarded to indexer:
abc;3244
ab1;testing 123
Try this in props.conf:
SEDCMD-something = s/^([^;]*;[^;]*).*$/\1/g
Note, if you want to change the event before it's forwarded you will need to use a heavy forwarder.
Try this in props.conf:
SEDCMD-something = s/^([^;]*;[^;]*).*$/\1/g
Note, if you want to change the event before it's forwarded you will need to use a heavy forwarder.
As in "remember previous events and only send different ones"?
No, as of now Splunk can't do that. You're limited to all the power of regular expressions, which do not have that kind of memory.
However, you can write your searches to deal with potential duplicates / events with no new interesting information.
Hi,
Not sure if splunk is able to do it, if i want the event to be forwarded to splunk index only when there is changes in the info before the 1st semi-colon? thks