Module 11: Manipulating Raw Data

Question 1

Why is it necessary to manipulate raw data?

Answer 1

• Anonymise, mask or delete sensitive or unwanted information
• Configure heavy forwarders or indexers to manipulate arriving data
• Splunk cloud customers us a heavy forwarder
• Two methods: SEDCMD like sed script or regex transform
• Use stanza based on host, source, sourcetype to select events

Question 2

How can you manipulate data with SEDCMD?

Answer 2

•Configured through props.conf
•Anonymise with sed script
o	SEDCMD-
o	s/ / /flags
o	flags: g – global or a number
o	Applied to _raw only
•Replaced characters with sed script
o	SEDCMD- - y//string2/

Question 3

How can you manipulate data with a regex transform?

Answer 3

•Configured through props and transforms
•Transforms.conf
o	REGEX – a PERC regex
o	FORMAT – arrange event post change
o	DEST_KEY – applied to field e.g raw
•Props.conf
o	TRANSFORM-
o	Comma separated list of transforms