Getting Data In

Can I get the length of a replacement or SEDCMD removal?

dart
Splunk Employee
Splunk Employee

If I have a SEDCMD that is removing data, can I get the length of data removed, eg:

### RAW EVENT
12:01:01 Recieved message : "The Quick Brown Fox Jumps Over The Lazy Dog"

### props.conf
[messages]
SEDCMD-censor = s/message : "[^"]+"/message : "XXX"/

### transformed event
12:01:01 Recieved message : "XXX"

### desired transformed event
12:01:01 Recieved message of length 44

Is this possible with SEDCMD or with a transform?

1 Solution

Ayn
Legend

No, you cannot. You'd need a scripted input to be able to achieve something like that.

View solution in original post

Ayn
Legend

No, you cannot. You'd need a scripted input to be able to achieve something like that.

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...