Getting Data In

How can I parse data before it is forwarded?

chinmoya
Communicator

My data at the forwarder end has 5 fields, say FLD1, FLD2, FLD3, FLD4, and FLD5.

I want only FLD1 & FLD4 to be forwarded to the indexer, and I want to drop the remaining fields.

How can I do this?

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

A Heavy Forwarder would be needed to do any filtering of data at the source. Otherwise you could do the filtering at the indexer side.

You could handle it like you would if you were trying to anonymize data, like when you mask a credit card number or other PII (Personally Identifiable Information). In that scenario, you are basically breaking the data into pieces, then concatenating it back together, replacing a piece of the data with X's or #'s, masking part of it.

In your scenario, you could use the same method, but instead of replacing some of the data with another character, you just concatenate the data you want, leaving out the data you don't want.

Take a look at this documentation on anonymizing data:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Anonymizedatausingconfigurationfiles

0 Karma

chinmoya
Communicator

I am using a heavy forwarder. Tried Regex and SEDCMD via props and transforms.

Not working. its still indexing the full thing.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...