Splunk Search

What pipeline processor does sed pre-indexing run in?

zscgeek
Path Finder

Question:

What pipeline module does the sed pre-indexing code run in. I have the following props.conf in my app and I would like to understand what the cpu impact is of running the SEDCMD-encode on my data sets.

props.conf:
[voxeo_hosted_file]
SEDCMD-encode = s/\\s/\//g s/(\\r)?\\n/\n/g s/\\t/\t/g
TRANSFORMS-a = vox-hosted-mega
REPORT-a = vox-hosted-mega
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
DATETIME_CONFIG = /etc/apps/voxsearch/datetime.xml
Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

I believe it occurs in the parsing queue, in the merging pipeline, in the regexreplacement processor.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

I believe it occurs in the parsing queue, in the merging pipeline, in the regexreplacement processor.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...