https://community.splunk.com/t5/Getting-Data-In/TRANSFORMS-ROUTING-filtering-out-source-address/m-p/394669#M70449 <P>You can try using SEDCMD in props.conf. Refer below documents:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Propsconf">http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Propsconf</A></P> Mon, 18 Jun 2018 14:09:10 GMT p_gurav 2018-06-18T14:09:10Z https://community.splunk.com/t5/Getting-Data-In/TRANSFORMS-ROUTING-filtering-out-source-address/m-p/394668#M70448 <P>I have set up a TRANSFORMS-ROUTING and it is forwarding data to a 3rd party however, they do not want to see the source address the logs are coming from. Is there a quick way i can remove the source IP form the data being sent over? </P> <P>the logs look like this-<BR /> timestamp 10.10.10.10 logs message blahhh foo blahhh foooooooo blahhh</P> <P>props-<BR /> [host::hostA*]<BR /> TRANSFORMS-ROUTING = send_to_party</P> <P>transforms -<BR /> [send_to_party]<BR /> REGEX = .<BR /> DEST_KEY = _SYSLOG_ROUTING<BR /> FORMAT = send_to_party_group_1</P> <P>outputs-<BR /> [syslog:send_to_party_group_1]<BR /> server = 10.22.22.22:514<BR /> type = udp<BR /> syslogSourceType = sourcetype::none</P> Tue, 29 Sep 2020 20:04:41 GMT https://community.splunk.com/t5/Getting-Data-In/TRANSFORMS-ROUTING-filtering-out-source-address/m-p/394668#M70448 sbattista09 2020-09-29T20:04:41Z https://community.splunk.com/t5/Getting-Data-In/TRANSFORMS-ROUTING-filtering-out-source-address/m-p/394669#M70449 <P>You can try using SEDCMD in props.conf. Refer below documents:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Propsconf">http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Propsconf</A></P> Mon, 18 Jun 2018 14:09:10 GMT https://community.splunk.com/t5/Getting-Data-In/TRANSFORMS-ROUTING-filtering-out-source-address/m-p/394669#M70449 p_gurav 2018-06-18T14:09:10Z https://community.splunk.com/t5/Getting-Data-In/TRANSFORMS-ROUTING-filtering-out-source-address/m-p/394670#M70450 <P>i should have said we are doing this on a HWF so this wont work because SEDCMD will only work at index time.. right? </P> Mon, 18 Jun 2018 17:15:35 GMT https://community.splunk.com/t5/Getting-Data-In/TRANSFORMS-ROUTING-filtering-out-source-address/m-p/394670#M70450 sbattista09 2018-06-18T17:15:35Z