outputs.conf add a delimiter

[robnewman666]

Is it possible to add a stanza field to outputs.conf on a light forwarder to add a delimiter to data that currently has none? I realise that if sending data (in this case, zeek logs), directly to Splunk this would work, but my data is going somewhere else first then to Splunk, which is why I need the data to be delimited before it's sent. Can it all be done in outputs.conf, or even can I add props.conf and transforms.conf on the light forwarder?

[robnewman666]

Thanks, thought so, but was just curious. It goes to a 3rd party app then onwards to Splunk, but as there's no delimiter, it doesn't play well. Will try something else in the mean time perhaps. 

[somesoni2]

Splunk Light Forwarder doesn't have capability to transform the data before routing it to destinations (Splunk and other thirdparty receivers). Do you want to transform data just for your thirdparty destination OR even data going to Splunk (Indexers) should have that change? If both needs same change, you can route it to your thirdparty receiver from Splunk Indexer after processing it.