topic Re: True-Client-IP=[12.34.56.78] in Getting Data In

True-Client-IP=[12.34.56.78]

daniel333 — Mon, 07 Mar 2016 22:47:20 GMT

All,

I have some header information coming through like so
True-Client-IP=[12.34.56.78]

I'd like to correct the data as it's ingested to be
True-Client-IP=12.34.56.78

Dropping the "[]" from around the IP address. Not sure where to start. I feel like I should be able to use SEDCMD inside props.conf but I am not sure how that would look.

Re: True-Client-IP=[12.34.56.78]

somesoni2 — Mon, 07 Mar 2016 23:54:33 GMT

Can you provide the complete event ? Just to ensure the SEDCMD for this doesn't affect any other portion of the data.

Re: True-Client-IP=[12.34.56.78]

jhall0007 — Tue, 23 May 2017 15:07:21 GMT

This is old post, but one suggestion would be to create a custom field in props

Search Head props.conf:
[]
EXTRACT-true_ip = True-Client-IP=[(?(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}))]

Re: True-Client-IP=[12.34.56.78]

aakwah — Thu, 25 May 2017 12:13:35 GMT

Minor modification, Extract should be in capital letters,

EXTRACT-true_ip = True-Client-IP=[(?(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}))]

Re: True-Client-IP=[12.34.56.78]

jhall0007 — Thu, 25 May 2017 13:01:42 GMT

Thanks you.