Getting Data In

My "rex mode=sed" works in search, but why does it not work configuring with SEDCMD in props.conf?

TiagoMatos
Path Finder

Hello,

I tried this

index=s4 *Error* | rex mode=sed field=_raw "s/(\w+\tError\t\d\t[^\t]*\s\d{4}\-\d{2}\-\d{2}\s\d{2}\:\d{2}\:\d{2}\s\([^\s]*\s)(\(\d+\)\)\s\w{3}\-\w{3}\-\d{5})(.*)/\2/g"

It works perfectly returning (1420)) SBL-UIF-00401 from

ObjMgrLog   Error   1   000f012e567243f0:0  2015-12-17 14:51:53 (cxsesmgr.cpp (655)) SBL-CFG-00157: O motor de execução do Siebel Product Configurator não foi inicializado.

When trying to put it on SEDCMD from props.conf:

SEDCMD-Error=s/(\w+\tError\t\d\t[^\t]*\s\d{4}\-\d{2}\-\d{2}\s\d{2}\:\d{2}\:\d{2}\s\([^\s]*\s)(\(\d+\)\)\s\w{3}\-\w{3}\-\d{5})(.*)/\2/

This doesn't substitute anything that it should!

Can anyone help me?

Thanks

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Have a look at definition of the SEDCMD in props.conf from here

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

In summary, it's only used at index time, so should be configured on Indexer/Heavy Forwarder and will work for any future data only. Existing data will not get modified.

You sure you want to update _raw (raw data) to just that value OR instead, extract the value as a field?? If it's the later, try this in your searches.

 index=s4 *Error* | rex "^(\S+\s+){8}(?<FieldName>\S+):"

You can put the field extraction in props.conf on Search Head like this

[sourcetypeName]
EXTRACT-fieldname = ^(\S+\s+){8}(?<FieldName>\S+):

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Have a look at definition of the SEDCMD in props.conf from here

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

In summary, it's only used at index time, so should be configured on Indexer/Heavy Forwarder and will work for any future data only. Existing data will not get modified.

You sure you want to update _raw (raw data) to just that value OR instead, extract the value as a field?? If it's the later, try this in your searches.

 index=s4 *Error* | rex "^(\S+\s+){8}(?<FieldName>\S+):"

You can put the field extraction in props.conf on Search Head like this

[sourcetypeName]
EXTRACT-fieldname = ^(\S+\s+){8}(?<FieldName>\S+):
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...