Splunk Search

What pipeline processor does sed pre-indexing run in?

zscgeek
Path Finder

Question:

What pipeline module does the sed pre-indexing code run in. I have the following props.conf in my app and I would like to understand what the cpu impact is of running the SEDCMD-encode on my data sets.

props.conf:
[voxeo_hosted_file]
SEDCMD-encode = s/\\s/\//g s/(\\r)?\\n/\n/g s/\\t/\t/g
TRANSFORMS-a = vox-hosted-mega
REPORT-a = vox-hosted-mega
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
DATETIME_CONFIG = /etc/apps/voxsearch/datetime.xml
Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

I believe it occurs in the parsing queue, in the merging pipeline, in the regexreplacement processor.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

I believe it occurs in the parsing queue, in the merging pipeline, in the regexreplacement processor.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...