SEDCMD is Not Working.

Applicability

Splunk Enterprise Splunk Cloud

Description

There are some scenarios where an administrator would need to anonymize, or mask, sensitive personal information from the data that is indexed into the Splunk platform, such as credit card or Social Security numbers. You can anonymize parts of confidential fields in events to protect privacy while providing enough remaining data for use in event tracking.

 

Investigation

To anonymize data with Splunk Enterprise, configure a Splunk Enterprise instance as a heavy forwarder and anonymize the incoming data with that instance before sending it to Splunk Enterprise.

There are two ways to anonymize data with a heavy forwarder:

• Use the SEDCMD setting. This setting exists in the props.conf configuration file, which you configure on the heavy forwarder. It acts like a sed *nix script to do replacements and substitutions. This method is more straightforward, takes less time to configure, and is slightly faster than a regular expression transform. But there are limits to how many times it can be invoked the SEDCMD setting and what it can do. For instructions on this method, see Anonymize data with a sed script.

• Use a regular expression (regex) transform. This method takes longer to configure but is less complex to modify after the initial configuration. It can also assign this method to multiple data inputs more flexibly. For instructions on this method, see Anonymize data with a regular expression transform.

Both of these options are also available in Splunk Enterprise, where you can complete the configuration on either a heavy forwarder or an indexer.

Resolution

Possible scenarios to consider if SEDCMD is not taking effect:

1. Ensure the regex matches the results you are aspiring for. 

2. Verify the class is not a duplicate from another SEDCMD attribute:
Wrong:

SEDCMD-myclass=s/.//g
SEDCMD-myclass=s/\s//g

Right:

SEDCMD-myclass=s/.//g
SEDCMD-myotherclass=s/\s//g

3. If a SED should change data after another SED, set the order by adding numbers to the class:

SEDCMD-001myclass=s/.//g
SEDCMD-002myotherclass=s/\s//g

4. Check if there is a conflict with an eval command by commenting on all evals temporarily. Sometimes, eval attributes that point to the same piece of raw data, may cause SEDCMD not to take effect.
5. If the SEDCMD is being set on a Cloud Indexer Cluster, and is not working, confirm if a Heavy Forwarder is parsing data before it gets to Cloud. If so, add the SEDCMD to the HF props.

If you continue to experience issues, check that Splunk was restarted and Splunk is working from a CLI, and use btool to confirm the sourcetype, or any other basic revisions that may have been overlooked.

Related Links

Caveats for anonymizing data

Anonymize data

 

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release