How to remove the null field values?

[AL3Z]

Hi,

How to remove the null field values from the  Palo cortex data lake stream logs to reduce the splunk volume ingestion..

Thanks 

[jcramasta_splun]

Things like ingest actions or even the new edge processor could this this. 

However, one thing Id recommend if these fields are always null values in every event is that you can remove them from being being sent in the first place using log filters on the palo cortex side.  You can pick and chose what fields are included in the HTTP export that is sent to Splunk.  

https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-start...

[PaulPanther]

You have to configure props.conf & transforms.conf to filter your data for reduction.

Check out following Splunk Docs and Splunk Answer thread with a similiar question.

Route and filter data - Splunk Documentation

Solved: Filtering events using NullQueue - Splunk Community