Getting Data In

SEDCMD question

bowesmana
SplunkTrust
SplunkTrust

I want to strip certain characters from my data on input. It changes the _raw data, but not the search time extracted fields. In particular I have a field 'Asset_Title' that I want to change certain chars in, so in props.conf I have

SEDCMD-Asset_Title = s/MP/ZZ/g

So, I see the raw data has all the MP changed to ZZ, but the field, 'Asset_Title' still shows the field with the MP.

I don't understand that and I am also not sure what the part of SEDCMD is supposed to mean - i.e. Asset_Title above - what is the purpose of that?

Also, now search Asset_Title=M* shows the titles starting with M, but search Asset_Title=MP* finds no hits and search Asset_Title=ZZ* also finds no hits. Uh???

Tags (1)
0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

The part of the name is somewhat arbitrary, it could be anything, it doesn't have to be the field name.

If you want to change only the Asset_Title field in your events, you should do something like this:

SEDCMD-title = s/Asset_Title=(MP)/Asset_Title=ZZ\1/g

The ZZ will replace what's in the capture group (MP in this case). You'll have to adjust the regex to match the values in the Asset_Title field, as I'm sure the above example won't quite do it. If you want to post an example of your data, I can post a more accurate answer.

0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

Yes, I think this syntax is probably best then:

SEDCMD- = y///

0 Karma

bowesmana
SplunkTrust
SplunkTrust

At the bottom is a line of data and what I am actually trying to do is replace any U+2018 or U+2019 chars with a 0x27. The first Field is Asset_Title and contain Tap 'n Print, where the ' is U+2018, so my SEDCMD is

SEDCMD-Asset_Title = s/(‘|’)/'/g

I used MP and ZZ as a proof of concept. I guess I could probably use the y/‘’/''/

Tap 'n Print,_scorm12_sppubknowledgera_o254ao,Custom Asset,username,FirstName,LastName,Vietnam,RVX125,0,2013-05-28,2013-07-22,41,0,,2013-07-22,Completed,,90.00,90.00,20,1670,Direct sales

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...