Two Question: Do you happen to know if:
-As far as performance goes, is there any difference in change the Transforms.conf or, add only SEDCMD on props.conf ?
-Also, the white spaces are related to Splunk way to deal with the Sed, or the regex need to be tweaked?
“EMULATION = [ ], APPLICATION = [ WEB HOSTED CLIENTID IPAD = Grant, PRACINSIGHTPHONE = Grant, DESKTOP PRACLAW CORP = Grant, KCALERT MONTHLY = Grant, COINV ALERTS = Grant, ANNOTATIONS = Grant, DESKTOP PRACLAW EMP = Grant, DESKTOP PRACLAW CAP = Grant, MYBI- BLC ZONE = Grant,
”
Thank you,
... View more