Getting Data In

SEDCMD not executing

jcbrendsel
Path Finder

I am trying to clean up some log data at index time using SEDCMD.

  1. I have a custom sourcetype (cloudfront_http) that is configured on the forwarding machine.

  2. On the receiver/indexer, I have added the following two lines in props.conf

    [cloudfront_http]
    SEDCMD-1-AppleTV = s/Apple%A0TV/AppleTV/g
    

The problem is that nothing is happening. The raw text 'Apple%A0TV' is still occuring and is not getting replaced.

Any ideas?

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

If this is a light forwarder, SEDCMD will not run there, and must be run on the indexer. Please see http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F for more details

DUThibault
Contributor

I can confirm that SEDCMD is ignored by a Universal Forwarder's local props.conf except if the sourcetype stanza's force_local_processing clause is = true (in which case a SEDCMD on the indexer will be ignored).

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

And the forwarder is a light forwarder? Or heavy? And there is no intermediate forwarder?

0 Karma

jcbrendsel
Path Finder

I am running SEDCMD on the indexer. But the data is coming from another machine (which is configured as a forwarder).

0 Karma

Ron_Naken
Splunk Employee
Splunk Employee

The SEDCMD will not retroactively change the values for data that is already indexed. Have you confirmed that it's not working on new data?

Ron_Naken
Splunk Employee
Splunk Employee

I meant to say that I tested your SEDCMD, and it works. I can't edit my comment above to change the wording.

0 Karma

Ron_Naken
Splunk Employee
Splunk Employee

The SEDCMD works. Try placing it on your forwarder -- it may not be configured as a light forwarder.

0 Karma

jcbrendsel
Path Finder

Correct. It is not working on new data. Are there any issues with orders of precedence? This is defined on a custom sourcetype which is defined in the forwarding server.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk Life | Splunk is Officially Part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint. Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...