transform field in sha256 before indexation

[splunkLPN]

is there a way to transform a field in sha256 before indexation? in the sourcetype ?

I can do that after using

| eval n=sha256 (getCanvasPrint)

but the field exceed 10000 and I want to reduce his size in a unique hash before to be truncated if possible.

thanks for you help.

[cpetterborg]

It isn't possible to run a function like sha256 on a value before indexing, unless you do it before it gets to the forwarder or the HEC. My suggestion would be to do this function before it gets touched by Splunk if you want to save that much licensing, or the data itself isn't that important.

Now if the data isn't needed at all you can remove it completely before indexing using a SEDCMD in your props.conf.