I have a powershell script that returns lines whose info will be ingested by Splunk in order to monitor DHCP Free Addresses.
The output is already heavily "treated", it looks like this (the &&& is a Splunk event breaker):
Subnet=10.31.3.0
AddressesInUse=0
AddressesFree=249
&&&
Subnet=10.31.4.0
AddressesInUse=0
AddressesFree=249
&&&
Subnet=10.31.9.0
AddressesInUse=0
AddressesFree=249
&&&
Subnet=10.32.1.0
AddressesInUse=32
AddressesFree=177
&&&
Subnet=10.34.1.0
AddressesInUse=98
AddressesFree=111
&&&
Though, I have a exception list with subnets values that must be ignored. I'm planing to write them to a text file, Get-Content from it, and replace the Subnet values in the variable (from the command result) that are -eq to any of the text file lines, turning it to "" (and then I'm planing to ignore them in Splunk with "IfNull(SubnetValue) then ignore event").
The expected results should look like this:
File SubnetExceptions.txt content example:
10.32.1.0
10.34.1.0
Expected result:
Subnet=10.31.3.0
AddressesInUse=0
AddressesFree=249
&&&
Subnet=10.31.4.0
AddressesInUse=0
AddressesFree=249
&&&
Subnet=10.31.9.0
AddressesInUse=0
AddressesFree=249
&&&
Subnet=
AddressesInUse=32
AddressesFree=177
&&&
Subnet=
AddressesInUse=98
AddressesFree=111
&&&
So that the ones that I wanted to ignore would come off as "null" values to Splunk, solving my problem :)
I've done a bit of replacing in my life, but never from a text file. My tests failed miserably. Could anyone help me to do it?
Thanks!
- David