Splunk rex expression to remove comma if present in json file-CodePudding

I have stuck in a small issue where I need to remove last character "," ( if present) from JSON log file. I am using it in Splunk.

It seems simple and I was hoping my regex will work but its not working. My Attempts :

1. s/\(,$\)?//g
2. s/,$//g
3. s/\(.*\),/\1/

FYI: My json file is nested, along with removing last character, I am removing some header and footers from this file and breaking the 1 event in multiple. Due to event break it has , at the end of each event. For better understanding can refer this link which I posted on Splunk Community fourm

CodePudding user response：

Actually there was an extra space at the end so below one is working but it cause another issue.

Working Regex s/$,\s$$//g

because I am using it with other regex and event break. Not event break is not working.

Other Regex

SEDCMD-removefooter = s/(\]\,).*//g
SEDCMD-removeheader = s/\{\"data\": \[//g
LINE_BREAKER = ([\r\n,]*(?:{[^[{] \[)?){"links"

CodePudding user response：

I resolved the issue

Working regex

SEDCMD-replacequotes = s/'/"/g
SEDCMD-removecomma = s/,\s$//g
SEDCMD-removefooter = s/(\]\,).*//g
SEDCMD-removeheader = s/\{.data.: \[//g