https://community.splunk.com/t5/Getting-Data-In/How-to-exclude-certain-fields-in-json-logs-from-being-displayed/m-p/279756#M53562 <P>Hi All,</P> <P>Is there a way to exclude certain fields from my JSON data? For example: I have the below JSON Format event with fields A , B and C.</P> <P>{</P> <P>A : XXXX..<BR /> B : YYYY...<BR /> C : ZZZZ....</P> <P>}</P> <P>Is there a way to remove the fields B and C along with its values from the search result?</P> Tue, 25 Oct 2016 10:43:35 GMT saranya_fmr 2016-10-25T10:43:35Z https://community.splunk.com/t5/Getting-Data-In/How-to-exclude-certain-fields-in-json-logs-from-being-displayed/m-p/279756#M53562 <P>Hi All,</P> <P>Is there a way to exclude certain fields from my JSON data? For example: I have the below JSON Format event with fields A , B and C.</P> <P>{</P> <P>A : XXXX..<BR /> B : YYYY...<BR /> C : ZZZZ....</P> <P>}</P> <P>Is there a way to remove the fields B and C along with its values from the search result?</P> Tue, 25 Oct 2016 10:43:35 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-exclude-certain-fields-in-json-logs-from-being-displayed/m-p/279756#M53562 saranya_fmr 2016-10-25T10:43:35Z https://community.splunk.com/t5/Getting-Data-In/How-to-exclude-certain-fields-in-json-logs-from-being-displayed/m-p/279757#M53563 <P>You can use <CODE>SEDCMD</CODE> to replace with empty strings. See if this link helps</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Anonymizedata">http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Anonymizedata</A></P> <P>props.conf</P> <PRE><CODE>[sourcetype stanza] SEDCMD-removefieldB = s/B:\w+//g SEDCMD-removefieldC = s/C:\w+//g </CODE></PRE> Tue, 25 Oct 2016 13:36:45 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-exclude-certain-fields-in-json-logs-from-being-displayed/m-p/279757#M53563 sundareshr 2016-10-25T13:36:45Z https://community.splunk.com/t5/Getting-Data-In/How-to-exclude-certain-fields-in-json-logs-from-being-displayed/m-p/279758#M53564 <P>Thankyou..</P> Wed, 26 Oct 2016 09:27:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-exclude-certain-fields-in-json-logs-from-being-displayed/m-p/279758#M53564 sarnagar 2016-10-26T09:27:37Z https://community.splunk.com/t5/Getting-Data-In/How-to-exclude-certain-fields-in-json-logs-from-being-displayed/m-p/279759#M53565 <P>Thankyou @sundareshr</P> Wed, 26 Oct 2016 09:47:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-exclude-certain-fields-in-json-logs-from-being-displayed/m-p/279759#M53565 saranya_fmr 2016-10-26T09:47:37Z https://community.splunk.com/t5/Getting-Data-In/How-to-exclude-certain-fields-in-json-logs-from-being-displayed/m-p/279760#M53566 <P>@saranya_fmr, if you accept this answer, please mark the "accept" link and @sarnagar will get delicious karma points and the rest of us will know this works as an answer.</P> Wed, 26 Oct 2016 15:54:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-exclude-certain-fields-in-json-logs-from-being-displayed/m-p/279760#M53566 sloshburch 2016-10-26T15:54:56Z