Getting Data In

SEDCMD not executing

jcbrendsel
Path Finder

I am trying to clean up some log data at index time using SEDCMD.

  1. I have a custom sourcetype (cloudfront_http) that is configured on the forwarding machine.

  2. On the receiver/indexer, I have added the following two lines in props.conf

    [cloudfront_http]
    SEDCMD-1-AppleTV = s/Apple%A0TV/AppleTV/g
    

The problem is that nothing is happening. The raw text 'Apple%A0TV' is still occuring and is not getting replaced.

Any ideas?

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

If this is a light forwarder, SEDCMD will not run there, and must be run on the indexer. Please see http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F for more details

DUThibault
Contributor

I can confirm that SEDCMD is ignored by a Universal Forwarder's local props.conf except if the sourcetype stanza's force_local_processing clause is = true (in which case a SEDCMD on the indexer will be ignored).

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

And the forwarder is a light forwarder? Or heavy? And there is no intermediate forwarder?

0 Karma

jcbrendsel
Path Finder

I am running SEDCMD on the indexer. But the data is coming from another machine (which is configured as a forwarder).

0 Karma

Ron_Naken
Splunk Employee
Splunk Employee

The SEDCMD will not retroactively change the values for data that is already indexed. Have you confirmed that it's not working on new data?

Ron_Naken
Splunk Employee
Splunk Employee

I meant to say that I tested your SEDCMD, and it works. I can't edit my comment above to change the wording.

0 Karma

Ron_Naken
Splunk Employee
Splunk Employee

The SEDCMD works. Try placing it on your forwarder -- it may not be configured as a light forwarder.

0 Karma

jcbrendsel
Path Finder

Correct. It is not working on new data. Are there any issues with orders of precedence? This is defined on a custom sourcetype which is defined in the forwarding server.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!