Getting Data In

How can I parse data before it is forwarded?

chinmoya
Communicator

My data at the forwarder end has 5 fields, say FLD1, FLD2, FLD3, FLD4, and FLD5.

I want only FLD1 & FLD4 to be forwarded to the indexer, and I want to drop the remaining fields.

How can I do this?

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

A Heavy Forwarder would be needed to do any filtering of data at the source. Otherwise you could do the filtering at the indexer side.

You could handle it like you would if you were trying to anonymize data, like when you mask a credit card number or other PII (Personally Identifiable Information). In that scenario, you are basically breaking the data into pieces, then concatenating it back together, replacing a piece of the data with X's or #'s, masking part of it.

In your scenario, you could use the same method, but instead of replacing some of the data with another character, you just concatenate the data you want, leaving out the data you don't want.

Take a look at this documentation on anonymizing data:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Anonymizedatausingconfigurationfiles

0 Karma

chinmoya
Communicator

I am using a heavy forwarder. Tried Regex and SEDCMD via props and transforms.

Not working. its still indexing the full thing.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...