topic Re: Why is the SEDCMD not working when ingesting a CSV via the web interface? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Why-is-the-SEDCMD-not-working-when-ingesting-a-CSV-via-the-web/m-p/372276#M67564 <P>Good catch. I was trying to come up with the simplest example possible, and had a typo. However, it still doesn't work (screenshot updated). Does it work for you?</P> Mon, 12 Feb 2018 13:19:41 GMT eugenek 2018-02-12T13:19:41Z Why is the SEDCMD not working when ingesting a CSV via the web interface? https://community.splunk.com/t5/Getting-Data-In/Why-is-the-SEDCMD-not-working-when-ingesting-a-CSV-via-the-web/m-p/372274#M67562 <P>Using the 7.0.1 web interface to ingest a CSV, and the SEDCMD command is not working. Tried reducing to the simplest possible scenario below.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/4364iBD189080C6AD53D4/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 09 Feb 2018 22:20:14 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-SEDCMD-not-working-when-ingesting-a-CSV-via-the-web/m-p/372274#M67562 eugenek 2018-02-09T22:20:14Z Re: Why is the SEDCMD not working when ingesting a CSV via the web interface? https://community.splunk.com/t5/Getting-Data-In/Why-is-the-SEDCMD-not-working-when-ingesting-a-CSV-via-the-web/m-p/372275#M67563 <P>You need a trailing slash (or more specifically, a slash to denote the end of your replacement string and the start of flags):</P> <PRE><CODE>SEDCMD-test = y/o/O/ </CODE></PRE> <P>From the props.conf SEDCMD section:</P> <PRE><CODE>substitute - y/string1/string2/ </CODE></PRE> Sat, 10 Feb 2018 02:40:43 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-SEDCMD-not-working-when-ingesting-a-CSV-via-the-web/m-p/372275#M67563 micahkemp 2018-02-10T02:40:43Z Re: Why is the SEDCMD not working when ingesting a CSV via the web interface? https://community.splunk.com/t5/Getting-Data-In/Why-is-the-SEDCMD-not-working-when-ingesting-a-CSV-via-the-web/m-p/372276#M67564 <P>Good catch. I was trying to come up with the simplest example possible, and had a typo. However, it still doesn't work (screenshot updated). Does it work for you?</P> Mon, 12 Feb 2018 13:19:41 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-SEDCMD-not-working-when-ingesting-a-CSV-via-the-web/m-p/372276#M67564 eugenek 2018-02-12T13:19:41Z Re: Why is the SEDCMD not working when ingesting a CSV via the web interface? https://community.splunk.com/t5/Getting-Data-In/Why-is-the-SEDCMD-not-working-when-ingesting-a-CSV-via-the-web/m-p/372277#M67565 <P>Upgraded to 7.1.0, and same issue.</P> Thu, 03 May 2018 18:58:14 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-SEDCMD-not-working-when-ingesting-a-CSV-via-the-web/m-p/372277#M67565 eugenek 2018-05-03T18:58:14Z