What is the correct example to redact a plain-text password from raw events?

This option uses an incorrect directive in props.conf that does not operate on raw event text - only SEDCMD can perform in-place raw string substitution within props.conf.

SEDCMD in props.conf applies a sed-style regular expression substitution to the raw event text before the event is written to the index, permanently replacing sensitive strings such as passwords. The correct syntax is SEDCMD-<name> = s/<regex>/<replacement>/g within the appropriate source or sourcetype stanza in props.conf, making it the only props.conf directive that modifies raw event content directly.

A standalone transforms.conf stanza cannot redact raw event text on its own - it must be paired with a TRANSFORMS reference in props.conf, and SEDCMD in props.conf is the simpler and more direct approach for raw text redaction.

This option uses incorrect transforms.conf syntax or a configuration designed to modify extracted field values rather than the underlying raw event text, which does not achieve raw-data redaction.