In which Splunk configuration is the SEDCMDused?