Getting Data In

Filter columns from CSV while monitoring

ankitarath2011
Path Finder

I am monitoring a folder with csv files with 400+ fields, out of which need only 50 fields for my dashboard.
Can we do something in Indexing time, so that it will not index the other 350 fields which are not required.

Removing from CSV is not possible. So, need to handle it in splunk only.

Please suggest.

0 Karma

woodcock
Esteemed Legend

You can do this with a carefully constructed SEDCMD setting but this may not work if you are using INDEXED_EXTRACTIONS=csv (then again, it may very well work). I know that it definitely will work if you are not using INDEXED_EXTRACTIONS.

0 Karma

KailA
Contributor

Hello,

I don't know if it's working for 400+ fields but I found this post for you : https://answers.splunk.com/answers/529138/filter-csv-logs-before-indexing.html

0 Karma

ankitarath2011
Path Finder

Ok, I will try this

0 Karma

KailA
Contributor

Let me know if it works

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...