Getting Data In

How do I get the first 96 bytes of a file?

daniel333
Builder

All,

I have a file just packed full of garbage. I really just want the first 96 characters of the file. I thought I could set TRUNCATE=96 on props.conf on my intermediate heavy forwarders and it would limit that to 96 characters, but that does not seem to the case.

Any recommendations? What I might be missing?

0 Karma

woodcock
Esteemed Legend

Use this instead:

SHOULD_LINEMERGE = false
LINE_BREAKER = (?!)
TRUNCATE = 96
# SEDCMD-keep_first_96_bytes = s/^(.{96}).*$/\1/
0 Karma

FrankVl
Ultra Champion

SEDCMD works on _raw, after linebreaking/merging, right? So that is not really going to do any better than truncate?

0 Karma

woodcock
Esteemed Legend

Good point, see updated answer.

0 Karma

FrankVl
Ultra Champion

Truncate works event by event, so if splunk breaks up the file into multiple events (e.g. 1 per line), then it will truncate each of those to 96 bytes.

So to make that truncate work, you'd have to make sure to set your linebreaking config such that it considers the whole file as 1 event.

But this might be one of those cases where it would be easier (and more efficient) to perhaps put some script in place that takes the first 96 bytes and writes it to a separate file for Splunk to read. That also resolves the challenge of dealing with the universal forwarder sending part of the file to one HF and part of the file to another due to auto load balancing.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...