topic Re: How to suppress one or two fields and associated values in csv file. in Splunk Search

How to suppress one or two fields and associated values in csv file.

lalithadevisegu — Fri, 22 Jan 2021 16:47:12 GMT

I have data following data in csv file. need to suppress last one or two columns. please suggest me how to do that.

1st row contains header information ,comma is delimiter

want suppress/nullify the "myField" and associated value. i tried with props.conf and transform.conf. but not working.

BusTargetId,HubId,MsgType,Priority,"Req_RespId","Source_IP","_raw","_time","command_type","endpoint_type",eventtype,gwTimestamp1,host,index,linecount,punct,source,sourcetype,"splunk_server","status_code",timestamp,"myField"
4DED32483ECD428A,100004030,Alert,2,rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7,"2001:470:b:654:225:fe8c:d410","Alert,rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7,2001:470:b:654:225:fe8c:d410,100004030,4DED32483ECD428A,ECHO,OUTAGE,2,1438432955000,,,SUCCESS, ","2020-06-12T12:08:53.000+0000",OUTAGE,ECHO,,1438432955000,uMhtVAppDPj11,"service_audit",1,",,::::::,,,,,,,,,,_","outage.txt",SMWAN,uMhtVAppDPj11,SUCCESS,none,name1
4DED32483ECD428A,100004031,Alert,2,rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7,"2001:470:b:654:225:fe8c:d410","Alert,rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7,2001:470:b:654:225:fe8c:d410,100004031,4DED32483ECD428A,ECHO,OUTAGE,2,1438432955000,,,SUCCESS, ","2020-06-12T12:08:53.000+0000",OUTAGE,ECHO,,1438432955000,uMhtVAppDPj11,"service_audit",1,",,::::::,,,,,,,,,,_","outage.txt",SMWAN,uMhtVAppDPj11,SUCCESS,none,name2

Appreciate your help!!

Re: How to suppress one or two fields and associated values in csv file.

landen99 — Fri, 22 Jan 2021 17:51:41 GMT

It depends on what you mean by "suppress" and what you mean by csv file. If the file is a lookup file in Splunk, you can add

| fields - myField

Or send that to outputlookup to another lookup that is shared with those who you don't want to see the last field.

If you are talking about indexing the csv, part of the configuration will have a props SED filter overwrite the data in the last column.

Re: How to suppress one or two fields and associated values in csv file.

lalithadevisegu — Fri, 22 Jan 2021 17:57:57 GMT

Have already indexed data , end customer added new field to the existing CSV file.

Newly added field and value should not be parsed in indexer. How to accomplish this. Please help me.

Re: How to suppress one or two fields and associated values in csv file.

lalithadevisegu — Fri, 22 Jan 2021 18:00:18 GMT

As end user don't want see the newly added CSV filed and it's value.