https://community.splunk.com/t5/Getting-Data-In/how-to-anonymize-and-route-specific-events/m-p/566714#M100720 <P>I want to anonymize one sourcetype before routing it to 3rd party system with Syslog. what is the proper config for props, transforms, and outputs config files?</P><P>When is use SEDCMD in props.conf, all events (for me and 3rd party system) will be anonymized, and when I use REGEX in transforms.conf for anonymizing, I&nbsp; can't route events to another system at the same transform stanza because FORMAT field should be used with _raw value.</P> Sat, 11 Sep 2021 13:47:52 GMT jg91 2021-09-11T13:47:52Z https://community.splunk.com/t5/Getting-Data-In/how-to-anonymize-and-route-specific-events/m-p/566714#M100720 <P>I want to anonymize one sourcetype before routing it to 3rd party system with Syslog. what is the proper config for props, transforms, and outputs config files?</P><P>When is use SEDCMD in props.conf, all events (for me and 3rd party system) will be anonymized, and when I use REGEX in transforms.conf for anonymizing, I&nbsp; can't route events to another system at the same transform stanza because FORMAT field should be used with _raw value.</P> Sat, 11 Sep 2021 13:47:52 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-anonymize-and-route-specific-events/m-p/566714#M100720 jg91 2021-09-11T13:47:52Z