Hi,
I want to replace a set of characters during indexing.
Say, My one log event in my log file is:
2012-05-08 12:02:06 "/core/hd_3pg/4.0" 127.0.0.1 a=4.5&c=NA&cl=false&d=SGH-T989&f=2.3.6_GINGERBREAD&l=INFO&log=7&v=log4j&p=android*%0D10%*0A3.1.85&time=1336478520
I will index full entry as-is in summary index. While indexing i would like to replace % of %0D as %25. % of %0A should be unaffected. So, the final entry inside summary index should be
2012-05-08 12:02:06 "/core/hd_3pg/4.0" 127.0.0.1 a=4.5&c=NA&cl=false&d=SGH-T989&f=2.3.6_GINGERBREAD&l=INFO&log=7&v=log4j&p=android*%25*0D10%0A3.1.85&time=1336478520
Thanks
Strive
I guess that you could create a sed script in props.conf
[your sourcetype]
SEDCMD-percent_replace = s/%0D/%250D/g
See more information here:
http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Anonymizedatausingconfigurationfiles
Hope this helps,
Kristian
I guess that you could create a sed script in props.conf
[your sourcetype]
SEDCMD-percent_replace = s/%0D/%250D/g
See more information here:
http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Anonymizedatausingconfigurationfiles
Hope this helps,
Kristian
Hi Kristian,
Thanks a lot.
This really helps me. I need to replace three sets of characters. Some sets i should replace with empty strings.
[your sourcetype]
SEDCMD-percent_replace = s/%0D/%250D/g s/%0A/ /g s/%0B%0C/ /g
Thanks
Strive