I want to anonymize one sourcetype before routing it to 3rd party system with Syslog. what is the proper config for props, transforms, and outputs config files?
When is use SEDCMD in props.conf, all events (for me and 3rd party system) will be anonymized, and when I use REGEX in transforms.conf for anonymizing, I can't route events to another system at the same transform stanza because FORMAT field should be used with _raw value.
