I have a set of events, each a JSON object, separated from each other as one-per-line (SHOULD_LINEMERGE = false), but each of the JSON objects ends its line of text with a trailing comma:
...}},
How do I use a SEDCMD to trim off that comma? Just this?
SEDCMD-remove-trailing-json-comma = s/,$/
...or do I need to match the line-feed at the end of each event too?
NOTE: I'm assuming I should put this SEDCMD into my props.conf on my Splunk heavy-forwarder, one-hop upstream from my core-indexer. Any advice is welcome. The above SEDCMD doesn't seem to work.
From the logs:
splunkd.log.2:03-30-2013 00:02:07.330 +0000 ERROR regexExtractionProcessor - Error while parsing sed name="SEDCMD-remove-trailing-json-comma", string="s/,$/", errMsg="Failed to initialize sed. Failed to parse the replacement string."
... View more