sedcmd incoming data based on host or index

[kritho]

Hi,
I have a SEDCMD simalar to

SEDCMD-remove-values = s/<Value>.+<\/Value>/removed-by-splunk/g  

which works fine, but i'd like to filter this to a spesific index, lets say "index!=dev"
is this possible?

brgs
Kristen

[yannK · Accepted solution]

Not really, the sedcmd applied to all data matching the stanza, and the stanza in props can only apply to : an exact sourcetype, or a source or a host.
There is not way to apply to a specific index.

You can try the host. example with props.conf

[host::*mydevhost*]
SEDCMD-remove-values = s/<Value>.+<\/Value>/removed-by-splunk/g