Splunk Search

how to skip a fixed number of characters after a conditional keyword

splunksogetiht
Explorer

I have a log that looks like that :

create message w-OtYwP8QD2WcAkmUgZEgg from DB and add it in the map.
create message cbB8MZnaRYmt1elBWW2i3w from DB and add it in the map.
Message 'P2S2mMJSTVSMO0OjrHh4Kw' was set to pause.
adding new message F6252jqPRbq6iaBLyiC6cw in Map - appli source = ASLC
ABDC parameter event received : parameter name = 'ACID', value = '---'.

I would like to skip the 22 characters that follow the keyword “message”. But that keyword is not present on all lines.
How shall I do that ?
Thank you
,

Tags (2)
0 Karma

OL
Communicator

Have you check the Splunk documentation: http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Anonymizedatausingconfigurationfiles . Did this help? If not, let us know why.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...