Installation

SEDCMD and license volume

southeringtonp
Motivator

When using SEDCMD to strip data from an event, does the entire event count toward license usage, or only the portion of the event that is actually retained?


For example, if I have an event like:

Field1=Something|Field2=SomethingReally....Long|Field3=SomethingElse

And apply:

SEDCMD=s/Field2=[^|]+//g

Will the contents of Field2 count against the license cap?

Tags (2)
1 Solution

twinspop
Influencer

gkanapathy has previously stated that SEDCMD substitutions happen before license accounting. So, no, the contents of Field2 should not be included in your license usage.

View solution in original post

twinspop
Influencer

gkanapathy has previously stated that SEDCMD substitutions happen before license accounting. So, no, the contents of Field2 should not be included in your license usage.

southeringtonp
Motivator

Ah, good catch! I looked for the previous answer but missed it somehow.

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...