Getting Data In

SEDCMD vs TRANSFORMS?

patricianaguit
Explorer

1) When to use SEDCMD?
2) When to use transforms and props for data masking?
3) Which is better?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi patricianaguit,

while SEDCMD and the props/transforms can do the same, SEDCMD is for index time only http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf (search for SEDCMD) and will be applied to your _raw events.
The props/transforms approach can do the same as SEDCMD in this regard, but it can also just be used for search time. That said, it will can not only change _raw events but it can also just change the search result without changing _raw.

To answer which is better; it all depends on your use case 😉

Hope this makes sense ...

cheers, MuS

View solution in original post

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi patricianaguit,

while SEDCMD and the props/transforms can do the same, SEDCMD is for index time only http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf (search for SEDCMD) and will be applied to your _raw events.
The props/transforms approach can do the same as SEDCMD in this regard, but it can also just be used for search time. That said, it will can not only change _raw events but it can also just change the search result without changing _raw.

To answer which is better; it all depends on your use case 😉

Hope this makes sense ...

cheers, MuS

View solution in original post

0 Karma

deepashri_123
Motivator

Hey@patricianaguit,

You can refer this link for better understanding:
https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata

Let me know if this helps!!!

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!