Splunk Search

How to remove commas from a field before indexing?

jasongori
Explorer

I have data that looks like this:

[2014-09-03T00:58:59.977-04:00] [octetstring] [NOTIFICATION] [OVD-20039] [com.octetstring.accesslog] [tid: 71] [ecid: 0000KWtsKqE4Iv8pVgx0ic1K1OL_000zrT,0] conn=150,801 op=0 RESULT err=0 tag=0 nentries=0 etime={3}

[2014-09-03T00:58:59.968-04:00] [octetstring] [WARNING] [] [com.octetstring.vde.backend.jndi.P-AD-INTERNAL-DMN-1.HeartBeatThread] [tid: 19] [ecid: 0000KWpedrsAXNzps0c9yX1K1Oji000005,0] Received exception javax.naming.CommunicationException: XXXX [Root exception is java.lang.NullPointerException]

[2014-09-03T00:58:59.936-04:00] [octetstring] [NOTIFICATION] [OVD-20071] [com.octetstring.accesslog] [tid: 28391] [ecid: 0000KWtpDSGAXNzps0XBiX1K1OmZ001T3R,0] conn=206,433 op=2 fd=0 closed - U1

In this data the conn values are actually connection ids. I need them to come in without the comma. How can I remove the comma pre-index? I'm assuming there's a way to transform it I've just never done so.

0 Karma

MarioM
Motivator

you could use SED in your props.conf, it s index time parameter thus will only apply to new data and need splunk restart:

SEDCMD-<class> = <sed script>
* Only used at index time.
* Commonly used to anonymize incoming data at index time, such as credit card or social
  security numbers. For more information, search the online documentation for "anonymize
  data."
* Used to specify a sed script which Splunk applies to the _raw field.
* A sed script is a space-separated list of sed commands. Currently the following subset of
  sed commands is supported:
        * replace (s) and character substitution (y).
* Syntax:
        * replace - s/regex/replacement/flags
                * regex is a perl regular expression (optionally containing capturing groups).
                * replacement is a string to replace the regex match. Use \n for backreferences,
                  where "n" is a single digit.
                * flags can be either: g to replace all matches, or a number to replace a specified
                  match.
        * substitute - y/string1/string2/
                * substitutes the string1[i] with string2[i]
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...