topic Why is SED command not working on Splunk Cloud? in Getting Data In

Why is SED command not working on Splunk Cloud?

rajeshmetso — Fri, 02 Dec 2022 15:07:12 GMT

I am sending windows system and security data to splunk cloud. Data is collected using UF and forwarded to cloud through HF.

I want to get rid of extra text in windows data (example:4624). I saw SED command stanzas are there in the documentation. I tried to place them in the sourcetype on splunk cloud, but it is not working. But same is working for my onprem indexer.

Not sure what is wrong. Any suggestions would be appreciated.

Re: SED command not working on splunk cloud

yuanliu — Fri, 02 Dec 2022 10:22:01 GMT

Ask in Getting Data In forum would be a good start as this is not a search problem.

Re: SED command not working on splunk cloud

ITWhisperer — Fri, 02 Dec 2022 10:24:08 GMT

Moved accordingly 😀