I have data that looks like this:
[2014-09-03T00:58:59.977-04:00] [octetstring] [NOTIFICATION] [OVD-20039] [com.octetstring.accesslog] [tid: 71] [ecid: 0000KWtsKqE4Iv8pVgx0ic1K1OL_000zrT,0] conn=150,801 op=0 RESULT err=0 tag=0 nentries=0 etime={3}
[2014-09-03T00:58:59.968-04:00] [octetstring] [WARNING] [] [com.octetstring.vde.backend.jndi.P-AD-INTERNAL-DMN-1.HeartBeatThread] [tid: 19] [ecid: 0000KWpedrsAXNzps0c9yX1K1Oji000005,0] Received exception javax.naming.CommunicationException: XXXX [Root exception is java.lang.NullPointerException]
[2014-09-03T00:58:59.936-04:00] [octetstring] [NOTIFICATION] [OVD-20071] [com.octetstring.accesslog] [tid: 28391] [ecid: 0000KWtpDSGAXNzps0XBiX1K1OmZ001T3R,0] conn=206,433 op=2 fd=0 closed - U1
In this data the conn values are actually connection ids. I need them to come in without the comma. How can I remove the comma pre-index? I'm assuming there's a way to transform it I've just never done so.
you could use SED in your props.conf, it s index time parameter thus will only apply to new data and need splunk restart:
SEDCMD-<class> = <sed script>
* Only used at index time.
* Commonly used to anonymize incoming data at index time, such as credit card or social
security numbers. For more information, search the online documentation for "anonymize
data."
* Used to specify a sed script which Splunk applies to the _raw field.
* A sed script is a space-separated list of sed commands. Currently the following subset of
sed commands is supported:
* replace (s) and character substitution (y).
* Syntax:
* replace - s/regex/replacement/flags
* regex is a perl regular expression (optionally containing capturing groups).
* replacement is a string to replace the regex match. Use \n for backreferences,
where "n" is a single digit.
* flags can be either: g to replace all matches, or a number to replace a specified
match.
* substitute - y/string1/string2/
* substitutes the string1[i] with string2[i]