Splunk Enterprise

SEDCMD not working on Splunk Stream Data



I am facing a weird situation where SEDCMD is working perfectly for all log sources except one i.e. Splunk Stream Data. This what I have in props.conf on the HF. The data is collected using UF and forwarded to HF which is then sent to Indexers.


SEDCMD-hidepasswords = y/<string1>/<string2>/


 The above regex is applied for all other source types but does not work on any source type generated from splunk stream data. The regex is correct as it works for other data which is in exact same form of the data from splunk stream. 

I want to know is there a specific reason behind this? such Splunk Stream data not being in structured form like other text-based data sources. 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...

Splunk Observability Cloud | Enhancing Your Onboarding Experience with the ...

We understand that your initial experience with getting data into Splunk Observability Cloud is crucial as it ...