Installation

SEDCMD and license volume

southeringtonp
Motivator

When using SEDCMD to strip data from an event, does the entire event count toward license usage, or only the portion of the event that is actually retained?


For example, if I have an event like:

Field1=Something|Field2=SomethingReally....Long|Field3=SomethingElse

And apply:

SEDCMD=s/Field2=[^|]+//g

Will the contents of Field2 count against the license cap?

Tags (2)
1 Solution

twinspop
Influencer

gkanapathy has previously stated that SEDCMD substitutions happen before license accounting. So, no, the contents of Field2 should not be included in your license usage.

View solution in original post

twinspop
Influencer

gkanapathy has previously stated that SEDCMD substitutions happen before license accounting. So, no, the contents of Field2 should not be included in your license usage.

southeringtonp
Motivator

Ah, good catch! I looked for the previous answer but missed it somehow.

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

  March 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

New This Month - Splunk Observability updates and improvements for faster ...

What’s New? This month, we’re delivering several enhancements across Splunk Observability Cloud for faster and ...

What's New in Splunk Cloud Platform 9.3.2411?

Hey Splunky People! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2411. This release ...