topic Re: Can I shorten frequent words? in Getting Data In

Can I shorten frequent words?

BoldKnowsNothin — Mon, 02 Oct 2023 07:46:12 GMT

Hello comrades,

I'm just curios is there anyway to shorten frequent words?

For example: <Data Name='IpAddress'>::ffff:10.95.81.99</Data>

IpAddress to ipaddr or something like IPa.

Many thanks,

Re: Can I shorten frequent words?

gcusello — Fri, 29 Sep 2023 10:20:36 GMT

Hi @BoldKnowsNothin,

did you tried field aliases (https://docs.splunk.com/Documentation/Splunk/9.1.1/Knowledge/Addaliasestofields)?

Ciao.

Giuseppe

Re: Can I shorten frequent words?

BoldKnowsNothin — Mon, 02 Oct 2023 00:46:40 GMT

Hello gcusello,

Sir, I just surfed that link you provided to me, many thanks.

But does this field alias reduces space?

Thanks again,

Re: Can I shorten frequent words?

inventsekar — Mon, 02 Oct 2023 01:24:58 GMT

>>> But does this field alias reduces space?

Do you mean, after doing data onboarding (so the fields are indexed properly), if you apply the field alias, will it reduce the index size?..

as per my understanding it wont reduce the index size ( Even if it reduces, it will only reduce very negligible amount only)

Re: Can I shorten frequent words?

BoldKnowsNothin — Mon, 02 Oct 2023 01:31:09 GMT

Hello inventsekar,

Sir, all this only for reduce our license usage, currently we afraid to exclude logs, and looking something else to reduce.

Many thanks,

Re: Can I shorten frequent words?

inventsekar — Mon, 02 Oct 2023 05:55:07 GMT

Hi @BoldKnowsNothin ... ya, i got it.. please note that, for the field names will not occupy lot of space.

lets say, you have a CSV file with three fields

field1,field2,field3longName data1,data2,data3

and then you have ten thousand data/records in that CSV file.

now, the field3 is named as "field3longName"... even if you use alias, the indexer will store it only once.

but, for license usage... you can analyze these 3 fields and if you dont want, lets say field2, .. then you can totally ignore the field2 while data onboarding. this will save lot of license.

hope you understood, thanks.

Re: Can I shorten frequent words?

gcusello — Mon, 02 Oct 2023 06:33:55 GMT

Hi @BoldKnowsNothin ,

what do you mean with "reduce space"?

alias are applied at search time, meaning there isn't any additional disk usage.

About license usage, the number of aliases or data elaborations don't consume any additional license: license is only the volume of daily indexed logs.

Ciao.

Giuseppe

Re: Can I shorten frequent words?

gcusello — Mon, 02 Oct 2023 09:50:35 GMT

Hi @BoldKnowsNothin ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉