Getting Data In

How can I parse data before it is forwarded?

chinmoya
Path Finder

My data at the forwarder end has 5 fields, say FLD1, FLD2, FLD3, FLD4, and FLD5.

I want only FLD1 & FLD4 to be forwarded to the indexer, and I want to drop the remaining fields.

How can I do this?

0 Karma

adhoke_splunk
Splunk Employee
Splunk Employee
0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

A Heavy Forwarder would be needed to do any filtering of data at the source. Otherwise you could do the filtering at the indexer side.

You could handle it like you would if you were trying to anonymize data, like when you mask a credit card number or other PII (Personally Identifiable Information). In that scenario, you are basically breaking the data into pieces, then concatenating it back together, replacing a piece of the data with X's or #'s, masking part of it.

In your scenario, you could use the same method, but instead of replacing some of the data with another character, you just concatenate the data you want, leaving out the data you don't want.

Take a look at this documentation on anonymizing data:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Anonymizedatausingconfigurationfiles

0 Karma

chinmoya
Path Finder

I am using a heavy forwarder. Tried Regex and SEDCMD via props and transforms.

Not working. its still indexing the full thing.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!