SEDCMD not being applied?

[jdmclemore]

I'm trying to do a seemingly simple SEDCMD replace of passwords in logs, but nothing is getting applied. I have pushed props.conf out to all the indexers in my cluster, but looking at new data nothing gets changed. Am I doing something wrong?

Sample log (sourcetype=access_log):
10.1.1.1 - - [09/May/2017:16:42:52 -0500] [GET /service/auth/login?user_name=JoeUser&password=realpassword HTTP/1.1] 200 2315 Cnt-Type=- Acc=- Resp-Cnt-Type=application/xml

Expected result:
10.1.1.1 - - [09/May/2017:16:42:52 -0500] [GET /service/auth/login?user_name=JoeUser&password=xxxxx HTTP/1.1] 200 2315 Cnt-Type=- Acc=- Resp-Cnt-Type=application/xml

In props.conf:

    [access_log]
    SEDCMD-replacepasswd = s/password=.+\s/password=xxxxx\s/g

[MuS · Accepted solution]

Also worth to mention that this must be on the parsing layer, so if there are heavy weight forwarder along the data pipe it must be put on them, see the docs for details about this http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationparametersandthedatapipeline#P...

cheers, MuS

[jdmclemore]

Thanks Mus - that did the trick. I included my SEDCMD stanza in a props.conf that gets distributed to my intermediate Heavy Forwarders and all is good.

[jdmclemore]

Ah, that may be it - I do use Heavy Forwarders as my intermediate forwarders. I'll push props.conf out to them and report back.

[richgalloway]

Did you restart the indexers after modifying props.conf?