Hi,
I have a SEDCMD simalar to
SEDCMD-remove-values = s/<Value>.+<\/Value>/removed-by-splunk/g
which works fine, but i'd like to filter this to a spesific index, lets say "index!=dev"
is this possible?
brgs
Kristen
Not really, the sedcmd applied to all data matching the stanza, and the stanza in props can only apply to : an exact sourcetype, or a source or a host.
There is not way to apply to a specific index.
You can try the host. example with props.conf
[host::*mydevhost*]
SEDCMD-remove-values = s/<Value>.+<\/Value>/removed-by-splunk/g
Not really, the sedcmd applied to all data matching the stanza, and the stanza in props can only apply to : an exact sourcetype, or a source or a host.
There is not way to apply to a specific index.
You can try the host. example with props.conf
[host::*mydevhost*]
SEDCMD-remove-values = s/<Value>.+<\/Value>/removed-by-splunk/g