Splunk Search

What pipeline processor does sed pre-indexing run in?

Path Finder

Question:

What pipeline module does the sed pre-indexing code run in. I have the following props.conf in my app and I would like to understand what the cpu impact is of running the SEDCMD-encode on my data sets.

props.conf:
[voxeo_hosted_file]
SEDCMD-encode = s/\\s/\//g s/(\\r)?\\n/\n/g s/\\t/\t/g
TRANSFORMS-a = vox-hosted-mega
REPORT-a = vox-hosted-mega
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
DATETIME_CONFIG = /etc/apps/voxsearch/datetime.xml
Tags (2)
1 Solution

Splunk Employee
Splunk Employee

I believe it occurs in the parsing queue, in the merging pipeline, in the regexreplacement processor.

View solution in original post

Splunk Employee
Splunk Employee

I believe it occurs in the parsing queue, in the merging pipeline, in the regexreplacement processor.

View solution in original post