CODEWITHSUNDEEP
jsoneventsfiltersplunk
Jakub
Jakub

Reputation: 23

Remove property from json event Splunk

I have events JSON events in splunk, but one of the key pair/property I would like to remove.

E.g.:

From below JSON I want to remove "country": "Algeria", from every event which will come. It is possible? I have tried something like this in my props.conf, but no success.

[k8s]
INDEXED_EXTRACTIONS=JSON
TRUNCATE = 200000
SEDCMD-remove=/"country": ".*/g


       {
            "random": 23,
            "random float": 28.173,
            "bool": false,
            "date": "1990-08-31",
            "regEx": "helloooooooooooooooooooooooooooooooooooooooooooooooooo world",
            "enum": "generator",
            "firstname": "Latisha",
            "lastname": "Alexandr",
            "city": "Tiraspol",
            "country": "Algeria",
            "countryCode": "MC",
            "email uses current data": "[email protected]",
            "email from expression": "[email protected]",
            "array": [
                "Dyann",
                "Christal",
                "Renie",
                "Tilly",
                "Margette"
            ],
            "array of objects": [
                {
                    "index": 0,
                    "index start at 5": 5
                },
                {
                    "index": 1,
                    "index start at 5": 6
                },
                {
                    "index": 2,
                    "index start at 5": 7
                }
            ],
            "Raquela": {
                "age": 50
            }
        }

Upvotes: 2

Views: 755

Answers (1)

RichG
RichG

Reputation: 9926

You have the right idea, but the SEDCMD is incorrect. Try this in your props.conf

SEDCMD-noAlgeria = s/"country": "Algeria",//

Upvotes: 1

Related Questions