Splunk Enterprise

Why is configuration recognized but not applied?

jkuppala
Splunk Employee
Splunk Employee

Configuration is recognized but not applied.
/opt/splunk/etc/apps/jk_cjbeck/local/props.conf SEDCMD-StripHeader = s/^[^{]+//

Labels (1)
Tags (1)
0 Karma

jkuppala
Splunk Employee
Splunk Employee

hey @scelikok ,

In the hf

 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @jkuppala,

Did you put this config to the indexer or heavy forwarder that data first ingested?

If this reply helps you an upvote and "Accept as Solution" is appreciated.

jkuppala
Splunk Employee
Splunk Employee

in hf

 

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...