sedcmd incoming data based on host or index

kritho — Fri, 09 Jun 2017 07:36:32 GMT

Hi,
I have a SEDCMD simalar to

SEDCMD-remove-values = s/<Value>.+<\/Value>/removed-by-splunk/g

which works fine, but i'd like to filter this to a spesific index, lets say "index!=dev"
is this possible?

brgs
Kristen

Re: sedcmd incoming data based on host or index

yannK — Fri, 09 Jun 2017 19:31:27 GMT

Not really, the sedcmd applied to all data matching the stanza, and the stanza in props can only apply to : an exact sourcetype, or a source or a host.
There is not way to apply to a specific index.

You can try the host. example with props.conf

[host::*mydevhost*]
SEDCMD-remove-values = s/<Value>.+<\/Value>/removed-by-splunk/g

topic sedcmd incoming data based on host or index in Getting Data In

sedcmd incoming data based on host or index

Re: sedcmd incoming data based on host or index