https://community.splunk.com/t5/Splunk-Enterprise/How-to-filter-fields-in-my-logs-before-to-index-in-splunk/m-p/658616#M17442 <P><BR />Hello, I need help to filter fields of an event and in this way reduce the size of the log before indexing it in splunk, I was reviewing the documentation and using ingest actions it is possible to exclude events based on regular expressions, however I do not need to exclude events if not specific fields</P> Mon, 25 Sep 2023 16:48:05 GMT Alejandro1195 2023-09-25T16:48:05Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-filter-fields-in-my-logs-before-to-index-in-splunk/m-p/658616#M17442 <P><BR />Hello, I need help to filter fields of an event and in this way reduce the size of the log before indexing it in splunk, I was reviewing the documentation and using ingest actions it is possible to exclude events based on regular expressions, however I do not need to exclude events if not specific fields</P> Mon, 25 Sep 2023 16:48:05 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-filter-fields-in-my-logs-before-to-index-in-splunk/m-p/658616#M17442 Alejandro1195 2023-09-25T16:48:05Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-filter-fields-in-my-logs-before-to-index-in-splunk/m-p/658746#M17450 <P>Hi,</P><P>I'd use SEDCMD in props.conf. You can find more details in the <A href="https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf" target="_self">props.conf.spec</A>. This is used for anonymization, but it should also work for your use case.</P><P>If you want detailed steps to set it up, you can follow this guide:&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.1.1/Data/Anonymizedata#Anonymize_data_with_a_sed_script" target="_self">Anonymize data with a sed script</A>.</P><P>smurf</P> Tue, 26 Sep 2023 12:05:37 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-filter-fields-in-my-logs-before-to-index-in-splunk/m-p/658746#M17450 smurf 2023-09-26T12:05:37Z