Getting Data In

Why is SED command not working on Splunk Cloud?

rajeshmetso
Engager

Hi

I am sending windows system and security data to splunk cloud. Data is collected using UF and forwarded to cloud through HF.

I want to get rid of extra text in windows data (example:4624). I saw SED command stanzas are there in the documentation. I tried to place them in the sourcetype on splunk cloud, but it is not working. But same is working for my onprem indexer.

Not sure what is wrong. Any suggestions would be appreciated.

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Ask in Getting Data In forum would be a good start as this is not a search problem.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Moved accordingly 😀

Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...