Why is SED command not working on Splunk Cloud?

rajeshmetso · ‎12-02-2022

Hi

I am sending windows system and security data to splunk cloud. Data is collected using UF and forwarded to cloud through HF.

I want to get rid of extra text in windows data (example:4624). I saw SED command stanzas are there in the documentation. I tried to place them in the sourcetype on splunk cloud, but it is not working. But same is working for my onprem indexer.

Not sure what is wrong. Any suggestions would be appreciated.

yuanliu · ‎12-02-2022

Ask in Getting Data In forum would be a good start as this is not a search problem.

ITWhisperer · ‎12-02-2022

Moved accordingly 😀

Why is SED command not working on Splunk Cloud?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Manage Edge Processor pipelines end to end with APIs

Join the Conversation

Why is SED command not working on Splunk Cloud?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Manage Edge Processor pipelines end to end with APIs