Getting Data In

Remove syslog prefix from Json

vbotnari1
Engager

I have a Json log which looks like this

Jul 11 14:37:48 darktrace-dt-722-01 darktrace {"creationTime":1562855937000,"breachUrl":...}

I have to remove the timestamp hostanem, all syslog prefixes until {

This is how my props.conf looks like

[darktrace]
SEDCMD-StripHeader = ^([^\{]+) 
KV_MODE = json
pulldown_type = true
category = Structured
description = darktrace

But it doesn't work. I tried INDEXED_EXTRACTIONS = json as well without success.

Any help is appreciated. Thanks

0 Karma
1 Solution

woodcock
Esteemed Legend

It must be an actual sed command like this:

 SEDCMD-StripHeader = s/^[^\{]+//

View solution in original post

woodcock
Esteemed Legend

It must be an actual sed command like this:

 SEDCMD-StripHeader = s/^[^\{]+//

vbotnari1
Engager

Thank you @woodcock . I tried your suggested sed command but it did nothing.

0 Karma

woodcock
Esteemed Legend

If you are doing a sourcetype override/overwrite, you must use the ORIGINAL value NOT the new value, then you must deploy this to the first full instance(s) of Splunk that handles the events (usually either the HF-tier, if you use this, or your Indexer tier), restart all Splunk instances there, send in new events (old events will stay broken), then test using _index_earliest=-5m to be absolutely certain that you are only examining the newly indexed events.

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...