Getting Data In

Why is SED command not working on Splunk Cloud?

rajeshmetso
Engager

Hi

I am sending windows system and security data to splunk cloud. Data is collected using UF and forwarded to cloud through HF.

I want to get rid of extra text in windows data (example:4624). I saw SED command stanzas are there in the documentation. I tried to place them in the sourcetype on splunk cloud, but it is not working. But same is working for my onprem indexer.

Not sure what is wrong. Any suggestions would be appreciated.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Ask in Getting Data In forum would be a good start as this is not a search problem.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Moved accordingly 😀

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...