https://community.splunk.com/t5/Getting-Data-In/sedcmd-replace-multiple-asterisk-with-single-asterisk/m-p/454131#M78617 <H1>on the Linux server command line I tested sed like below and it works.</H1> <P>echo \"SMSESSION\", \"Value\": \"*****************************************<EM>\", | sed 's/[</EM>]+/*/g'</P> <H1>"SMSESSION", "Value": "*",</H1> <P>but how do I apply SEDCMD to achieve the above within a props file on the Intermediate heavy forwarders.</P> <P>I used the following and it did not work<BR /> SEDCMD-remove_star_value=s/SMSESSION", "Value":[^,\s]+/SMSESSION", "Value":X/g</P> <P>Can you please let me know where I am going wrong ?</P> Wed, 30 Sep 2020 01:09:10 GMT MeenaGoel 2020-09-30T01:09:10Z https://community.splunk.com/t5/Getting-Data-In/sedcmd-replace-multiple-asterisk-with-single-asterisk/m-p/454131#M78617 <H1>on the Linux server command line I tested sed like below and it works.</H1> <P>echo \"SMSESSION\", \"Value\": \"*****************************************<EM>\", | sed 's/[</EM>]+/*/g'</P> <H1>"SMSESSION", "Value": "*",</H1> <P>but how do I apply SEDCMD to achieve the above within a props file on the Intermediate heavy forwarders.</P> <P>I used the following and it did not work<BR /> SEDCMD-remove_star_value=s/SMSESSION", "Value":[^,\s]+/SMSESSION", "Value":X/g</P> <P>Can you please let me know where I am going wrong ?</P> Wed, 30 Sep 2020 01:09:10 GMT https://community.splunk.com/t5/Getting-Data-In/sedcmd-replace-multiple-asterisk-with-single-asterisk/m-p/454131#M78617 MeenaGoel 2020-09-30T01:09:10Z