topic Re: Is it possible to remove data from an event before indexing? in Getting Data In

Is it possible to remove data from an event before indexing?

rune_hellem — Wed, 29 Jul 2015 05:16:32 GMT

I've been asked to index a new sourcetype which is a set of XML-files. The files contains a tag

<attachments>...</attachments>

which I want to skip, since it is of no value at all indexing the attachment as raw data...it just makes it harder to see the forest for all the trees.

Could this be done?

Update
Realized that the most obvious answer is "Preprocess the files, remove the tag then index the file", but still hoping that Splunk can be told to do this for me.

Re: Is it possible to remove data from an event before indexing?

rsennett_splunk — Tue, 29 Sep 2020 06:49:28 GMT

In props.conf you can use the command:
SEDCMD

http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Anonymizedatausingconfigurationfiles#Anonymize_data_through_a_sed_script

This doc talks about anonymizing data using a SED script... and what it does is match a pattern and replace it in the example.
You'll do the same, but replace it with nothing... You can try the effect using the Data onboarding wizard (Add Data)

But it would be something like this:

props.conf SEDCMD - dumpAttach = /s\[^\<]+\<\/attachments\>//g

Re: Is it possible to remove data from an event before indexing?

rune_hellem — Wed, 29 Jul 2015 07:59:48 GMT

That did the trick!!

Re: Is it possible to remove data from an event before indexing?

rsennett_splunk — Wed, 29 Jul 2015 17:37:52 GMT

Great! 🙂