True-Client-IP=[12.34.56.78]

[daniel333]

All,

I have some header information coming through like so
True-Client-IP=[12.34.56.78]

I'd like to correct the data as it's ingested to be
True-Client-IP=12.34.56.78

Dropping the "[]" from around the IP address. Not sure where to start. I feel like I should be able to use SEDCMD inside props.conf but I am not sure how that would look.

[jhall0007]

This is old post, but one suggestion would be to create a custom field in props

Search Head props.conf:
[]
EXTRACT-true_ip = True-Client-IP=[(?(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}))]

[aakwah]

Minor modification, Extract should be in capital letters,

EXTRACT-true_ip = True-Client-IP=[(?(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}))]

[jhall0007]

Thanks you.

[somesoni2]

Can you provide the complete event ? Just to ensure the SEDCMD for this doesn't affect any other portion of the data.