Hello. I'm attempting to reduce the volume of log message with full text of terms and conditions, through using SEDCMD command in props.conf at Indexer machine. For that I created the following sed regex: "s/(?<=General Terms and Conditions)(?s)(.*$)/.../g" When i test it in Splunk using | rex field=_raw mode=sed "s/(?<=General Terms and Conditions)(?s)(.*$)/.../g" it replaces full text with "General Terms and Conditions..." which is good. Does that mean that I can safely copy this in props.conf as SEDCMD="s/(?<=General Terms and Conditions)(?s)(.*$)/.../g" or syntax there is different? Asking because currently we have a single search-head|indexer machine which I can't restart freely each time I want to test something, so I'm looking for another way to make sure it will work. ... View more