All,
I have some header information coming through like so
True-Client-IP=[12.34.56.78]
I'd like to correct the data as it's ingested to be
True-Client-IP=12.34.56.78
Dropping the "[]" from around the IP address. Not sure where to start. I feel like I should be able to use SEDCMD inside props.conf but I am not sure how that would look.
This is old post, but one suggestion would be to create a custom field in props
Search Head props.conf:
[]
EXTRACT-true_ip = True-Client-IP=[(?(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}))]
Minor modification, Extract should be in capital letters,
EXTRACT-true_ip = True-Client-IP=[(?(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}))]
Thanks you.
Can you provide the complete event ? Just to ensure the SEDCMD for this doesn't affect any other portion of the data.