|
Hi! I'm trying to replace parts of a string, in order to make it more human-readable. Our logs contains strings like this one: And I want to show it like: I've extracted the inner part using: And for the values I've tried using replace, but it won't let me replace the inner part of the string. I'm trying with makemv, but I can't get what I want. Is this possible? |
|
You should be able to do this with rex's sed mode, similar to this: This should also be usable as a "SEDCMD" in your props.conf file to edit the incoming data on the fly as it comes into splunk. Great! thanks dwaddle, I owe you a beer!
(03 Sep '10, 20:40)
hbazan
|
|
One simple and low-tech way is to use eval's 'replace' function. its not the prettiest but it might not make your head hurt as much as using rex in 'sed' mode. =) after your rex:
put this:
and while we're considering nutty solutions, here's another one. Again tack this onto the end of your rex where you're extracting the Properties string.
that last one actually makes multivalued field and then splits them into their own rows... mileage/applicability may vary. |
