I have a system X that sends syslog to a Splunk HF which then sends to Splunk Cloud.
The syslog contains the same data in the fields msg and desc, so I'd like to remove the field desc in Splunk HF before sending the syslog. How can I do that?
I thought about using transforms.conf and props.conf (https://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Discard_specific_e...), but this is used for dropping the entire log.
You can use props and transforms to remove the desc part without dropping the entire log. You need to build a good regex in order to "select" and remove just the bits you want. This is also used in case you need to anonymise any part of your data before indexing it to splunk. In your case instead of replacing said data with "xxxx" you can replace it with nothing.
Check this example:
https://community.splunk.com/t5/Getting-Data-In/Anonymize-Data-in-Splunk-Search/m-p/238539
You can use props and transforms to remove the desc part without dropping the entire log. You need to build a good regex in order to "select" and remove just the bits you want. This is also used in case you need to anonymise any part of your data before indexing it to splunk. In your case instead of replacing said data with "xxxx" you can replace it with nothing.
Check this example:
https://community.splunk.com/t5/Getting-Data-In/Anonymize-Data-in-Splunk-Search/m-p/238539
Thanks, that's exactly what I end up doing after I posted this thread xD