topic Re: How would we extract only certain cookies from cs_cookies at indexing so we don't save all cookies? in Getting Data In

How would we extract only certain cookies from cs_cookies at indexing so we don't save all cookies?

ryaker — Fri, 23 Mar 2018 15:43:43 GMT

We are trying to decrease the amount of data we are indexing from iis.
We have turned on adding the cookie to the iis log for specific cookies we wish to monitor and analyze, and do not need other cookie data that is just churning through our data quota.
What would the transform be to only extract certain cookies, and not index all of cs_cookie with each iis entry?

Re: How would we extract only certain cookies from cs_cookies at indexing so we don't save all cookies?

tiagofbmm — Fri, 23 Mar 2018 15:49:44 GMT

Hey

Follow this guide to discard events and keep others:

http://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest

Re: How would we extract only certain cookies from cs_cookies at indexing so we don't save all cookies?

ryaker — Fri, 23 Mar 2018 16:15:54 GMT

We don't want to discard events. We want to reduce the size of an event by only capturing some data from a given field within an event. reducing the size of the field.

Re: How would we extract only certain cookies from cs_cookies at indexing so we don't save all cookies?

tiagofbmm — Fri, 23 Mar 2018 16:20:45 GMT

Ok so I believe you can do a SEDCMD to replace what you don't need by nothing

https://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Anonymizedata#Define_the_sed_script_in_props.conf

Re: How would we extract only certain cookies from cs_cookies at indexing so we don't save all cookies?

tiagofbmm — Sat, 24 Mar 2018 07:09:02 GMT

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that