I have a log that looks like that :
create message w-OtYwP8QD2WcAkmUgZEgg from DB and add it in the map.
create message cbB8MZnaRYmt1elBWW2i3w from DB and add it in the map.
Message 'P2S2mMJSTVSMO0OjrHh4Kw' was set to pause.
adding new message F6252jqPRbq6iaBLyiC6cw in Map - appli source = ASLC
ABDC parameter event received : parameter name = 'ACID', value = '---'.
I would like to skip the 22 characters that follow the keyword “message”. But that keyword is not present on all lines.
How shall I do that ?
Thank you
,
Have you check the Splunk documentation: http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Anonymizedatausingconfigurationfiles . Did this help? If not, let us know why.