how to remove this annoying character?

Question

In my log file there at the end of a file there is substitution character x1A, here is the file with that character. I've tried following:

props.conf
SEDCMD-stripsub = s/\\x1A//g
SEDCMD-stripnull = s/\\x00//g

For null characters x00 it works perfectly fine, but not the substitution character. Any suggestions how to get rid of it?

Accepted Answer

1

You shouldn't be escaping the \. If you want to remove a character with hex code x1a, you should use s/\x1a//g. When you see \x1A in the actual raw event, that's simply because Splunk substituted the non-printable character with a printable character sequence. I have no idea why the second one worked, unless your raw data contains the printable string rather than the null character itself.

link

answered 25 Oct '11, 10:56

gkanapathy ♦
32.4k●4●8●27
accept rate: 41%

Feel stupid :) thanks it works

(26 Oct '11, 03:16) giovere

how to remove this annoying character?

Follow this question

Splunk Resources

Related questions