A customer wants to mask unstructured data before sending it to Splunk Cloud. Where should SEBCMD be configured for this?

The SEDCMD configuration is used to modify raw event data at index time. The question requires masking data before it is sent to Splunk Cloud. This necessitates a component that can parse and modify data on the customer's premises. A Universal Forwarder is lightweight and does not parse data; it forwards raw data as-is. A Heavy Forwarder, however, is a full Splunk Enterprise instance that can perform parsing, filtering, and data modification. Therefore, SEDCMD must be configured in props.conf on a Heavy Forwarder to mask the data before it is transmitted to Splunk Cloud.

A. props. conf on a Splunk Cloud search head,

This is incorrect because the configuration would be applied after the data is already in Splunk Cloud, and SEDCMD is an index-time, not a search-time, setting.

C. transforms, cent on a Splunk Cloud indexer.

This is incorrect as customers do not have file-level access to Splunk Cloud indexers. Furthermore, SEDCMD is a setting within props.conf, not transforms.conf.

D. props. conf- on a Universal Forwarder.

This is incorrect because Universal Forwarders do not perform data parsing or modification; they are designed to forward raw data with minimal processing overhead and cannot use SEDCMD.

1. Splunk Enterprise Documentation, Forwarding Data Manual: In the section "Types of forwarders," it is specified that a heavy forwarder can "parse data before forwarding it," which is a prerequisite for using SEDCMD. In contrast, a universal forwarder "does not parse data." This establishes the Heavy Forwarder as the correct component for this task. (See "Compare forwarder types" in the Forwarding Data manual).

2. Splunk Enterprise Documentation, Getting Data In Manual: The section "Anonymize data" explicitly details the use of SEDCMD for data masking. It states, "You can use SEDCMD in props.conf to run a sed script on your data... Splunk software runs the script on the data before it indexes it." This confirms SEDCMD is the correct tool and props.conf is the correct file.

3. Splunk Cloud Platform Documentation, Getting Data into Splunk Cloud Platform Manual: This manual outlines the data ingestion architecture for Splunk Cloud, emphasizing the role of forwarders (Universal or Heavy) as the primary method for sending data. It clarifies that data processing, such as masking, must occur on the customer-managed forwarder tier before data is sent to the cloud platform. (See "Forward data to Splunk Cloud Platform").