All Apps and Add-ons

Disabling indexed fields for CIsco DNA

_joe
Communicator

Hello all,


Just wondering if anyone else is removed index time extractions for the Cisco DNA Center Add-on (6668). I don't like that it needlessly indexes fields then resolved the duplicate-field issue by disabling KV_MODE.

I was thinking of adding something like this to the app props.conf but I am still looking better options.

 

 

INDEXED_EXTRACTIONS = 
KV_MODE=JSON
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n\[\]\,]+\s*)([\{])
Labels (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...