Why is SED command not working on Splunk Cloud?

[rajeshmetso]

Hi

I am sending windows system and security data to splunk cloud. Data is collected using UF and forwarded to cloud through HF.

I want to get rid of extra text in windows data (example:4624). I saw SED command stanzas are there in the documentation. I tried to place them in the sourcetype on splunk cloud, but it is not working. But same is working for my onprem indexer.

Not sure what is wrong. Any suggestions would be appreciated.

[yuanliu]

Ask in Getting Data In forum would be a good start as this is not a search problem.

[ITWhisperer]

Moved accordingly 😀