topic Re: How to edit inputs.conf to exclude a field before indexing? in Getting Data In

How to edit inputs.conf to exclude a field before indexing?

vikas_gopal — Mon, 12 Dec 2016 12:38:47 GMT

I am using Windows Host Monitoring stanza in inputs.conf like

([WinHostMon://Service]
interval = 10
disabled = 0
type = Service)
to collect service information on the windows machine . I got following in splunk .

Type=Service
Name="AeLookupSvc"
DisplayName="Application Experience"
Description="Processes application compatibility cache requests for applications as they are launched"
Path="C:\Windows\system32\svchost.exe -k netsvcs"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0

I do not want to index Description and Path Field. Please suggest how I can achieve this.

Thanks
VG

Re: How to edit inputs.conf to exclude a field before indexing?

dkeck — Mon, 12 Dec 2016 13:07:43 GMT

Hi,

there are historic questions regarding this topic , for example

https://answers.splunk.com/answers/109253/how-to-filter-or-extract-fields-before-indexing-time.html

Kind regards

Re: How to edit inputs.conf to exclude a field before indexing?

dkeck — Tue, 28 Feb 2017 10:53:05 GMT

Please accept answer, if it was helpfull.

Thank you

Re: How to edit inputs.conf to exclude a field before indexing?

Yorokobi — Tue, 30 Apr 2019 22:49:06 GMT

In your indexing tier's props.conf

[WinHostMon]
### This affects ALL WinHostMon source types for the v6+ add-on
SEDCMD-nodesc = s/([\r\n]+)Description=".+"//g
SEDCMD-nopath = s/([\r\n]+)Path=".+"//g

Or to apply to only WinHostMon's Service source

[source::service]
SEDCMD-nodesc = s/([\r\n]+)Description=".+"//g
SEDCMD-nopath = s/([\r\n]+)Path=".+"//g