Is there a way to apply a SED like filter after a search. The plumbing is there to filter and sanitize data going into the indexer. You could achieve this with a custom search command but is there another way? Would be handy if there was a props config.
asked 02 Jun '10, 14:33
You have two options. Either use the
Now, if if you are asking if you case setup something like a
Here is a possible workaround: If your sed command is really long and ugly and you simply don't want to see it or don't want to repeat it in multiple searches, then I would suggest that you create a macro with your
answered 02 Jun '10, 14:35
There are some tricks, but I would just stick with expressing them in the search query language (with either
Note that the existing "automatic" extractions and lookups at search time are not merely syntactic replacements for
But you can make things automatic. Note that doing this will also probably make it incredibly confusing to search for items, even if you're looking right at them:
This only works however if the change you're trying to make to a field is simply slicing out one part of it. If you need to do something more complicated, you do need a custom script, but you can use a lookup to get it to run automatically. A lookup, like an extraction, won't overwrite an initially returned field, so you'd do similar to the above:
Well, you have to have an external script instead of using Splunk to set regexes here.
answered 02 Jun '10, 16:43