Hello, please, I would like to know if the SEDCMD command is able to change metadata values like host, source and sourcetype.
Thanks in advance.
No, the SEDCMD option is only valid for the raw event text (ie. the _raw field).
View solution in original post