https://community.splunk.com/t5/Getting-Data-In/How-to-ingest-a-selection-of-JSON-fields/m-p/603731#M105034 <P>I have a dump.json file that collects events in JSON format:<BR />{"key":"value","key":"value","key":"value","key":"value"....}</P> <P>I have no problem processing it however each line has 400 Keys and I only need 30 of them in splunk.</P> <P>How can I tell the Universal forwarder to only send those 30 fields to my Indexers?<BR />Ingesting all the 400 fields consumes a lot of resources and license.</P> Wed, 29 Jun 2022 20:43:04 GMT PeraltaRH 2022-06-29T20:43:04Z https://community.splunk.com/t5/Getting-Data-In/How-to-ingest-a-selection-of-JSON-fields/m-p/603731#M105034 <P>I have a dump.json file that collects events in JSON format:<BR />{"key":"value","key":"value","key":"value","key":"value"....}</P> <P>I have no problem processing it however each line has 400 Keys and I only need 30 of them in splunk.</P> <P>How can I tell the Universal forwarder to only send those 30 fields to my Indexers?<BR />Ingesting all the 400 fields consumes a lot of resources and license.</P> Wed, 29 Jun 2022 20:43:04 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-ingest-a-selection-of-JSON-fields/m-p/603731#M105034 PeraltaRH 2022-06-29T20:43:04Z https://community.splunk.com/t5/Getting-Data-In/How-to-ingest-a-selection-of-JSON-fields/m-p/603861#M105040 Hi<BR /><BR />With UF I suppose that the easiest way is use modify the producer so that it writes only those needed events on that json. I suppose that there is some program which continuously writes this file one event per line?<BR /><BR />With HF, you could use props and transforms for get ride of unwanted values.<BR /><BR />r. Ismo Wed, 29 Jun 2022 20:29:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-ingest-a-selection-of-JSON-fields/m-p/603861#M105040 isoutamo 2022-06-29T20:29:06Z