Hi,
I am facing a weird situation where SEDCMD is working perfectly for all log sources except one i.e. Splunk Stream Data. This what I have in props.conf on the HF. The data is collected using UF and forwarded to HF which is then sent to Indexers.
[default]
SEDCMD-hidepasswords = y/<string1>/<string2>/
The above regex is applied for all other source types but does not work on any source type generated from splunk stream data. The regex is correct as it works for other data which is in exact same form of the data from splunk stream.
I want to know is there a specific reason behind this? such Splunk Stream data not being in structured form like other text-based data sources.
