This one is relatively simple. Save this as a text file(script.txt), then add the action to run the script. Make sure the boxes to read and write common fields are checked. After that action create another action to forward the message to the other syslog server.
Function Main()
CleanMsg = Fields.VarCleanMessageText
arrSplits = split(CleanMsg, ",")
Fields.VarCleanMessageText = arrsplits(2) & VbCrLf & arrSplits(7) & VbCrLf & arrSplits(8) & VbCrLf & arrSplits(12)
Main = "OK"
End Function
If your content isn't in those fields add this after the 'split' command in the script. Then change the array item numbers to match the content you need.
x=o
for each item in arrSplits
wscript.echo "arrSplits(" & x & "): " & item & VbCrLf
x=x+1
next
Remove or comment out this section or at least the 'wscript.echo' line when it works as expected.
After each update to the script you need to click 'Apply' or 'OK' in the setup screen to reload the script.
