Splunk Enterprise

SEDCMD not working on Splunk Stream Data

ashutoshab
Communicator

Hi,

I am facing a weird situation where SEDCMD is working perfectly for all log sources except one i.e. Splunk Stream Data. This what I have in props.conf on the HF. The data is collected using UF and forwarded to HF which is then sent to Indexers.

 

[default]
SEDCMD-hidepasswords = y/<string1>/<string2>/

 

 The above regex is applied for all other source types but does not work on any source type generated from splunk stream data. The regex is correct as it works for other data which is in exact same form of the data from splunk stream. 

I want to know is there a specific reason behind this? such Splunk Stream data not being in structured form like other text-based data sources. 

Labels (2)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!