Hi all!
There is a way to prevent the indexing of unnecessary fields? i'm indexing a syslog file from a firewall so i can do this at syslog server side but if it's possible I'd rather do it in splunk.
@davidepala you can have a scripted input to push only required data/fields to Splunk.
You can also use REGEX or SEDCMD to find regular expression based pattern and replace with space.
https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata
If you have to omin entire event from being indexed you can use nullqueue
@davidepala you can have a scripted input to push only required data/fields to Splunk.
You can also use REGEX or SEDCMD to find regular expression based pattern and replace with space.
https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata
If you have to omin entire event from being indexed you can use nullqueue
TOP, you've save my day! tnx man!!!
@davidepala, anytime. Please accept the answer if it helped. Do let us know if you need further help 🙂