Anonymize data feature supported by universal forwarder or free version?

[zerolife]

Is the anonymize data feature (through the props config file) supported by either a universal forwarder (without indexing) or the free version?

What I'm trying to setup is a Splunk instance that anonymizes certain data but does not have to index, and then forward the anonymized data to an already enterprise licensed Splunk environment. The receiving / indexing Splunk is run by a different group so sharing their license may be a bit more complex.

Thanks for any help

[martin_mueller]

A Universal Forwarder does not parse its data, so it can not anonymize anything regardless of license level. You can however use a Heavy Forwarder to do parsing and anonymization before data is sent to the indexers. The HF doesn't need an enterprise license as long as it doesn't need to index data locally or has to support authentication.