Discard one or more fields of a specific event without losing the rest of the fields of this event?

[jfeitosa_real]

Hi All,

Please, how to discard one or more fields of a specific event without losing the rest of the fields of this event?

It's possible?

Thank you very much in advance.

James

[richgalloway]

See https://answers.splunk.com/answers/4752/disabling-or-removing-extra-description-text-in-windows-2008...

[jfeitosa_real]

@richgalloway . In my case, they are Fortigate firewall logs.
How would it work if I were to discard the fields srcintfrole = "undefined" and dstintfrole = "undefined" for example.

See log example:

Jan 4 15:02:17 10.1.1.1 date=2019-01-04 time=15:04:13 devname="fwA1" devid="FWA11" logid="0000000010" type="traffic" subtype="forward" level="notice" vd="root" eventtime=1546621453 srcip=10.2.2.1 srcport=54256 srcintf="port1" srcintfrole="undefined" dstip=216.152.102.6 dstport=443 dstintf="port1" dstintfrole="undefined" sessionid=410471 poluuid="1348e-602-5e8-7fb-bfbab974" dstcountry="Brazil" srccountry="Reserved" service="HTTPS" wanoptapptype="web-proxy" proto=6 action="accept" duration=0 policyid=103 policytype="proxy-policy" user="USER1" group="G-Default" wanin=0 rcvdbyte=0 wanout=0 lanin=1418 sentbyte=1418 lanout=2561 appcat="unscanned" utmaction="allow" countweb=1

Thanks!

[richgalloway · Accepted solution]

Those are two fairly small fields. Unless all events contain them, you're likely not saving much by eliminating them. The example I cited removed hundreds of characters from verbose Windows events.

If you still want to do it, the trick is to create a regular expression that parses your event into groups of wanted and unwanted text. Then the FORMAT setting puts only the wanted groups into the event.

[jfeitosa_real]

Just by complementing, it would be a way to reduce the size of the log by reducing license consumption before indexing the events.

Thanks!