topic Re: SEDCMD not executing in Getting Data In

SEDCMD not executing

jcbrendsel — Tue, 15 Feb 2011 08:21:46 GMT

I am trying to clean up some log data at index time using SEDCMD.

I have a custom sourcetype (cloudfront_http) that is configured on the forwarding machine.
On the receiver/indexer, I have added the following two lines in props.conf
```
[cloudfront_http]
SEDCMD-1-AppleTV = s/Apple%A0TV/AppleTV/g
```

The problem is that nothing is happening. The raw text 'Apple%A0TV' is still occuring and is not getting replaced.

Any ideas?

Re: SEDCMD not executing

Ron_Naken — Tue, 15 Feb 2011 08:24:18 GMT

The SEDCMD will not retroactively change the values for data that is already indexed. Have you confirmed that it's not working on new data?

Re: SEDCMD not executing

jcbrendsel — Tue, 15 Feb 2011 09:24:24 GMT

Correct. It is not working on new data. Are there any issues with orders of precedence? This is defined on a custom sourcetype which is defined in the forwarding server.

Re: SEDCMD not executing

gkanapathy — Tue, 15 Feb 2011 09:32:32 GMT

If this is a light forwarder, SEDCMD will not run there, and must be run on the indexer. Please see http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F for more details

Re: SEDCMD not executing

Ron_Naken — Tue, 15 Feb 2011 14:44:02 GMT

The SEDCMD works. Try placing it on your forwarder -- it may not be configured as a light forwarder.

Re: SEDCMD not executing

jcbrendsel — Tue, 15 Feb 2011 16:50:37 GMT

I am running SEDCMD on the indexer. But the data is coming from another machine (which is configured as a forwarder).

Re: SEDCMD not executing

Ron_Naken — Tue, 15 Feb 2011 16:53:22 GMT

I meant to say that I tested your SEDCMD, and it works. I can't edit my comment above to change the wording.

Re: SEDCMD not executing

gkanapathy — Wed, 16 Feb 2011 06:06:08 GMT

And the forwarder is a light forwarder? Or heavy? And there is no intermediate forwarder?

Re: SEDCMD not executing

DUThibault — Tue, 30 Jan 2018 19:06:29 GMT

I can confirm that SEDCMD is ignored by a Universal Forwarder's local props.conf except if the sourcetype stanza's force_local_processing clause is = true (in which case a SEDCMD on the indexer will be ignored).