Does "rex mode=sed" pass as SEDCMD regex check?

[selenith]

Hello. I'm attempting to reduce the volume of log message with full text of terms and conditions, through using SEDCMD command in props.conf at Indexer machine.
For that I created the following sed regex:

"s/(?<=General Terms and Conditions)(?s)(.*$)/.../g"

When i test it in Splunk using
| rex field=_raw mode=sed "s/(?<=General Terms and Conditions)(?s)(.*$)/.../g"
it replaces full text with "General Terms and Conditions..." which is good.

Does that mean that I can safely copy this in props.conf as SEDCMD="s/(?<=General Terms and Conditions)(?s)(.*$)/.../g" or syntax there is different? Asking because currently we have a single search-head|indexer machine which I can't restart freely each time I want to test something, so I'm looking for another way to make sure it will work.

[richgalloway · Accepted solution]

The syntax is the same in props.conf, except the sed command string is not enclosed in quotation marks.

For test purposes, you may be able to install Splunk on your workstation and use a small sample of the data.