Splunk rex expression to remove comma if present in json file

Question

I have stuck in a small issue where I need to remove last character "," ( if present) from JSON log file. I am using it in Splunk.

It seems simple and I was hoping my regex will work but its not working. My Attempts :

1. s/\(,$\)?//g
2. s/,$//g
3. s/\(.*\),/\1/

FYI: My json file is nested, along with removing last character, I am removing some header and footers from this file and breaking the 1 event in multiple. Due to event break it has , at the end of each event. For better understanding can refer this link which I posted on Splunk Community fourm https://community.splunk.com/t5/Getting-Data-In/Updated-Help-in-event-break-for-json-file/td-p/569676

score 0 · Answer 1 · answered Oct 06 '21 at 09:43

0

Actually there was an extra space at the end so below one is working but it cause another issue.

Working Regex s/$,\s$$//g

because I am using it with other regex and event break. Not event break is not working.

Other Regex

SEDCMD-removefooter = s/(\]\,).*//g
SEDCMD-removeheader = s/\{\"data\": \[//g
LINE_BREAKER = ([\r\n,]*(?:{[^[{]+\[)?){"links"

answered Oct 06 '21 at 09:43

Ankit Goyal

did you solve your problem? – warren Oct 06 '21 at 13:17
yes finally... SEDCMD-replacequotes = s/'/"/g SEDCMD-removecomma = s/,\s$//g SEDCMD-removefooter = s/(\]\,).*//g SEDCMD-removeheader = s/\{.data.: \[//g – Ankit Goyal Oct 06 '21 at 15:01

score 0 · Answer 2 · answered Oct 06 '21 at 15:02

0

I resolved the issue

Working regex

SEDCMD-replacequotes = s/'/"/g
SEDCMD-removecomma = s/,\s$//g
SEDCMD-removefooter = s/(\]\,).*//g
SEDCMD-removeheader = s/\{.data.: \[//g

answered Oct 06 '21 at 15:02

Ankit Goyal

don't give multiple answers to your question, edit an answer you give to be complete :) – warren Oct 06 '21 at 20:17

2 Answers2