Which of the following statements is true about data transformations using SEDCMD?

Which of the following statements is true about data transformations using SEDCMD?

A. Can only be used to mask or truncate raw data.

B. Configured in props.conf and transform.conf.

C. Can be used to manipulate the sourcetype per event.

D. Operates on a REGEX pattern match of the source, sourcetype, or host of an event.

View Answer

Answer: A

Explanation:

SEDCMD is a directive used within the props.conf file in Splunk to perform inline data transformations. Specifically, it uses sed-like syntax to modify data as it is being processed.

A. Can only be used to mask or truncate raw data: This is the correct answer because SEDCMD is typically used to mask sensitive data, such as obscuring personally identifiable information (PII) or truncating parts of data to ensure privacy and compliance with security policies. It is not used for more complex transformations such as changing the sourcetype per event.

B. Configured in props.conf and transform.conf: Incorrect, SEDCMD is only configured in props.conf. C. Can be used to manipulate the sourcetype per event: Incorrect, SEDCMD does not manipulate the s ourcetype.

D. Operates on a REGEX pattern match of the source, sourcetype, or host of an event: Incorrect,

while SEDCMD uses regex for matching patterns in the data, it does not operate on the source,

sourcetype, or host specifically.

Splunk Documentation

Reference: SEDCMD Usage

Mask Data with SEDCMD