Archive

Removal of unnecessary fields BEFORE INDEX

Path Finder

Hi all!
There is a way to prevent the indexing of unnecessary fields? i'm indexing a syslog file from a firewall so i can do this at syslog server side but if it's possible I'd rather do it in splunk.

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

@davidepala you can have a scripted input to push only required data/fields to Splunk.
You can also use REGEX or SEDCMD to find regular expression based pattern and replace with space.

https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata

If you have to omin entire event from being indexed you can use nullqueue

http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data_...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@davidepala you can have a scripted input to push only required data/fields to Splunk.
You can also use REGEX or SEDCMD to find regular expression based pattern and replace with space.

https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata

If you have to omin entire event from being indexed you can use nullqueue

http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data_...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

Path Finder

TOP, you've save my day! tnx man!!!

0 Karma

SplunkTrust
SplunkTrust

@davidepala, anytime. Please accept the answer if it helped. Do let us know if you need further help 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma