Ok now I understand what universal forwarder client means. Thanks 🙂 ... View more

From my point of view it makes more sense to anonymize data from the Forwarder and not on the server. That's why I always tried to configure the forwarder. ... View more

I found it! I was configuring the forwarder and not the server! Note with 6.1 props.conf might have to go on the UFs. From dev: With 6.1, the structured data props.conf are happening at monitoring time therefore the props.conf has also to be on the forwarders. makes me on the right way. Thanks for the help 🙂 ... View more

I even try with another server, it does not work... Our forwarder has the version 5.0.4. ... View more

Yes, i'm refreshing the page, which produce a log with the date, so I'm sure. ... View more

Even with y/e/g the props.conf does not work... ... View more

Even this does not work. ... View more

I always restarted before. With your debug option I even can read /opt/splunkforwarder/etc/system/local/props.conf SEDCMD-ipi2 = y/e/g/g . It seams that it does not appear as much as the other lines. But the letter e still appears on the splunk server. ... View more