Splunk Enterprise

SEDCMD not working on Splunk Stream Data



I am facing a weird situation where SEDCMD is working perfectly for all log sources except one i.e. Splunk Stream Data. This what I have in props.conf on the HF. The data is collected using UF and forwarded to HF which is then sent to Indexers.


SEDCMD-hidepasswords = y/<string1>/<string2>/


 The above regex is applied for all other source types but does not work on any source type generated from splunk stream data. The regex is correct as it works for other data which is in exact same form of the data from splunk stream. 

I want to know is there a specific reason behind this? such Splunk Stream data not being in structured form like other text-based data sources. 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...