I have a set of events, each a JSON object, separated from each other as one-per-line (SHOULD_LINEMERGE = false), but each of the JSON objects ends its line of text with a trailing comma:
...}},
How do I use a SEDCMD to trim off that comma? Just this?
SEDCMD-remove-trailing-json-comma = s/,$/
...or do I need to match the line-feed at the end of each event too?
NOTE: I'm assuming I should put this SEDCMD into my props.conf on my Splunk heavy-forwarder, one-hop upstream from my core-indexer. Any advice is welcome. The above SEDCMD doesn't seem to work.
From the logs:
splunkd.log.2:03-30-2013 00:02:07.330 +0000 ERROR regexExtractionProcessor - Error while parsing sed name="SEDCMD-remove-trailing-json-comma", string="s/,$/", errMsg="Failed to initialize sed. Failed to parse the replacement string."
Try SEDCMD-remove-trailing-json-comma = s/\,$//
Thanks - this ended up working for me, very similar. Yeah, I missed that final /
SEDCMD-remove-trailing-json-comma = s/,$//
I updated your syntax slightly. SEDCMD
(like its sed
great-grandfather) looks for a "find" and a "replace" which are (by convention) separated by the /
character. So, to remove a trailing comma, you need to have the "replace" be an empty string.