Refine your search:

SEDCMD and license volume

0

When using SEDCMD to strip data from an event, does the entire event count toward license usage, or only the portion of the event that is actually retained?

For example, if I have an event like:

Field1=Something|Field2=SomethingReally....Long|Field3=SomethingElse

And apply:

SEDCMD=s/Field2=[^|]+//g

Will the contents of Field2 count against the license cap?

asked 06 Apr '11, 17:38

southeringtonp's gravatar image

southeringtonp ♦
4.5k●1●2●15
accept rate: 35%

One Answer:
oldestnewestmost voted
1

gkanapathy has previously stated that SEDCMD substitutions happen before license accounting. So, no, the contents of Field2 should not be included in your license usage.

link

answered 06 Apr '11, 17:49

twinspop's gravatar image

twinspop
444●1●16
accept rate: 38%

Ah, good catch! I looked for the previous answer but missed it somehow.

(06 Apr '11, 17:56) southeringtonp ♦
Post your answer
toggle preview

Copyright © 2005-2012 Splunk, Inc. All rights reserved.