sending only part of logs to server

[harishd]

Hi,

I have been trying to extract a part of my events in logs before they are sent to indexing server.
I trying with SEDCMD but it is not working. Please let me know how exactly do i have to configure my props.conf. Im doing like this.

[source::sample_http.rtf]
SEDCMD-lighteniislogs =

Are there any other way to achive this.

[woodcock]

Yes, that is how to do it; full details are here:

http://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedatausingconfigurationfiles

Do note that you will have to make sure that this props.conf is sent to all of your indexers and that each indexer is restarted before it will take effect.