topic Re: Remove 1 field from syslog before sending to Splunk Cloud? in Getting Data In

Remove 1 field from syslog before sending to Splunk Cloud?

JChris_ — Thu, 18 Aug 2022 08:56:34 GMT

I have a system X that sends syslog to a Splunk HF which then sends to Splunk Cloud.

The syslog contains the same data in the fields msg and desc, so I'd like to remove the field desc in Splunk HF before sending the syslog. How can I do that?

I thought about using transforms.conf and props.conf (https://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest), but this is used for dropping the entire log.

Re: Remove 1 field from syslog before sending to Splunk Cloud?

diogofgm — Thu, 18 Aug 2022 09:52:28 GMT

You can use props and transforms to remove the desc part without dropping the entire log. You need to build a good regex in order to "select" and remove just the bits you want. This is also used in case you need to anonymise any part of your data before indexing it to splunk. In your case instead of replacing said data with "xxxx" you can replace it with nothing.

Check this example:
https://community.splunk.com/t5/Getting-Data-In/Anonymize-Data-in-Splunk-Search/m-p/238539

Re: Remove 1 field from syslog before sending to Splunk Cloud?

JChris_ — Thu, 18 Aug 2022 09:53:44 GMT

Thanks, that's exactly what I end up doing after I posted this thread xD