I have set up a TRANSFORMS-ROUTING and it is forwarding data to a 3rd party however, they do not want to see the source address the logs are coming from. Is there a quick way i can remove the source IP form the data being sent over?
the logs look like this-
timestamp 10.10.10.10 logs message blahhh foo blahhh foooooooo blahhh
props-
[host::hostA*]
TRANSFORMS-ROUTING = send_to_party
transforms -
[send_to_party]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = send_to_party_group_1
outputs-
[syslog:send_to_party_group_1]
server = 10.22.22.22:514
type = udp
syslogSourceType = sourcetype::none
You can try using SEDCMD in props.conf. Refer below documents:
http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Propsconf
i should have said we are doing this on a HWF so this wont work because SEDCMD will only work at index time.. right?