topic Re: Indexing only partial events in Getting Data In

Indexing only partial events

thiru25 — Thu, 11 Dec 2014 19:54:37 GMT

Hello, I have 1000s files that I am indexing but I only need first 3 fields to be indexed in each event, is there an efficient way to do this?

Here is an example: Log header with tab delimited fields, I only need to index first 3 fields "v1 Time | Datagrams | Messages" and discard other garbage.

v1 Time Datagrams Messages Total missed datagrams Total retransmission requests Total unrecognized messages Total
processed messages Total ignored messages Total invalid messages Last rx

Thanks,
Thiru.

Re: Indexing only partial events

btt — Mon, 28 Sep 2020 18:26:15 GMT

Hi
I think you can do it by configure file setups for index-time field extractions

When Splunk Enterprise reads file, if there are colums with empty row it does not index that header field or any of the rows in
it. This means that neither header or any of the data in its row can be searched for in the index.

So if your unwanted fieldshave empty rows(all rows) splunk would not indexed them.
You can read about Props.conf attributes for structured data in data manual.
see the MISSING_VALUE_REGEX attribute

Hope,this could help

Re: Indexing only partial events

btt — Mon, 12 Jan 2015 12:50:46 GMT

I find the answer below who seems similar with your question
http://answers.splunk.com/answers/42260/index-only-part-of-a-log.html

is this what you where looking for?