# SPLK-1003 — Question 604

**Type:** multiple_choice
**Topics:** topic_1

## Question

Using SEDCMD in props.conf allows raw data to be modified. With the given event below, which option will mask the first three digits of the AcctID field resulting output: [22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309
Event:
[22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309

## Correct Answer

_See scenario._

## Explanation

should be D. the \1 indicates the capture group, should come after the xxx not before

**Reference:** examtopics_top_comment

---
Source: https://hiexam.net/q/splunk/SPLK-1003/604  
Practice (tracked): https://hiexam.net/study/SPLK-1003/practice