topic Re: How do you discard specific fields and keep the rest? in Splunk Search

How do you discard specific fields and keep the rest?

rakeshksingh — Mon, 19 Nov 2018 07:13:55 GMT

Hi All,

Could you please let me know how to discard specific fields and keep the rest while indexing in Splunk ?

like
field 1=a
field 2 =b
field 3 = c
field 4 =d

Fields 1-3 have to be discarded and only field 4 needs to be shown in Splunk events /_raw

Thanks
Rakesh Singh

Re: How do you discard specific fields and keep the rest?

harishalipaka — Mon, 19 Nov 2018 07:33:44 GMT

hi @rakeshksingh

try like this ..

index=summary_data where field=4

Re: How do you discard specific fields and keep the rest?

493669 — Mon, 19 Nov 2018 07:43:13 GMT

Hi @rakeshksingh,
Go through this document to Discard specific events and keep the rest
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues

Re: How do you discard specific fields and keep the rest?

FrankVl — Mon, 19 Nov 2018 08:38:22 GMT

If you want to modify your raw events (and as a result also the fields that get extracted from those at searchtime), the SEDCMD in props.conf is usually the best option.

Can you share some sample raw events and an example of the desired output? Then we can sure help you with that.

Re: How do you discard specific fields and keep the rest?

rakeshksingh — Mon, 19 Nov 2018 08:47:07 GMT

It will be discarding specific events but not fields of that event.

sample logs :-

{"message":" 2017-06-12 08:32:30,585 INFO main org.apache.coyote.ajp.AjpNioProtocol - Initializing ProtocolHandler [\"ajp-nio-8009\"]","time":1497256350}

https://answers.splunk.com/storage/temp/205746-kafkadocker.jpg

So i need only message fields

Re: How do you discard specific fields and keep the rest?

rakeshksingh — Mon, 19 Nov 2018 08:47:59 GMT

added the sample logs and requirement

Re: How do you discard specific fields and keep the rest?

rakeshksingh — Mon, 19 Nov 2018 08:49:13 GMT

thanks for query but it all the fields are in one raw event

Re: How do you discard specific fields and keep the rest?

FrankVl — Mon, 19 Nov 2018 09:07:39 GMT

So you just want to strip of that timestamp part? I'm a little curious as to why, but still, try this in props.conf:

[kafka:topicEvent]
SEDCMD-striptimestamp = s/,"time":\d+//

https://regex101.com/r/Ecb0rZ/1

NOTE: SEDCMD takes place at indextime, but after timestamping happens, so if you use that timestamp to populate _time, that would still work.