Getting Data In

TRANSFORMS-ROUTING filtering out source address

sbattista09
Contributor

I have set up a TRANSFORMS-ROUTING and it is forwarding data to a 3rd party however, they do not want to see the source address the logs are coming from. Is there a quick way i can remove the source IP form the data being sent over?

the logs look like this-
timestamp 10.10.10.10 logs message blahhh foo blahhh foooooooo blahhh

props-
[host::hostA*]
TRANSFORMS-ROUTING = send_to_party

transforms -
[send_to_party]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = send_to_party_group_1

outputs-
[syslog:send_to_party_group_1]
server = 10.22.22.22:514
type = udp
syslogSourceType = sourcetype::none

0 Karma

p_gurav
Champion

You can try using SEDCMD in props.conf. Refer below documents:
http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Propsconf

0 Karma

sbattista09
Contributor

i should have said we are doing this on a HWF so this wont work because SEDCMD will only work at index time.. right?

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...