Getting Data In

index time SED from props.conf

jbower
New Member

Are the SED commands in props.conf excuted in order? In other words

Note: (All the following is under [default])

Can I write a test to set a field so it will fail a SED test

SEDCMD-callid =s/(.*callid)(=)(.*)/\1~\3/g

then run the main SED test

SEDCMD-ssnmask = s/(.*[ :=;,])(?!000)(?!666)(?!9)\d{3}[ -](?!00)\d\d[ -](?!0000)(\d{4}[ =;,&].*)/\1###SSN-SCRUBBED###\2/g
SEDCMD-ssnmask1 = s/(.*[ :=;,])(?!000)(?!666)(?!9)\d{3}(?!00)\d\d(?!0000)(\d{4}[ ;,&=].*)/\1###SSN-SCRUBBED###\2/g

and then change it back

SEDCMD-callid_fix =s/(.*callid)(~)(.*)/\1=\3/g

or might the indexer not always run the SED commands in that order?

Tags (1)
0 Karma

jbower
New Member

I found how you do it (put all the SED commands on one line)
so

SEDCMD-Master = s/(.[ :=;,])(?!000)(?!666)(?!9)d{3} -dd -(d{4}[ =;,&].)/1###SSN-SCRUBBED###2/g s/(.[ :=;,])(?!000)(?!666)(?!9)d{3}(?!00)dd(?!0000)(d{4}[ ;,&=].)/1###SSN-SCRUBBED###2/g

and then thay will get excuted in order.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...