How can I parse data before it is forwarded?

[chinmoya]

My data at the forwarder end has 5 fields, say FLD1, FLD2, FLD3, FLD4, and FLD5.

I want only FLD1 & FLD4 to be forwarded to the indexer, and I want to drop the remaining fields.

How can I do this?

[adhoke_splunk]

Can you look at these sample answers and see if it works.

https://answers.splunk.com/answers/41875/online-interactive-regular-expression-tester-for-splunk-reg...

https://answers.splunk.com/answers/417488/how-to-configure-props-and-transformsconf-to-renam.html

[kmorris_splunk]

A Heavy Forwarder would be needed to do any filtering of data at the source. Otherwise you could do the filtering at the indexer side.

You could handle it like you would if you were trying to anonymize data, like when you mask a credit card number or other PII (Personally Identifiable Information). In that scenario, you are basically breaking the data into pieces, then concatenating it back together, replacing a piece of the data with X's or #'s, masking part of it.

In your scenario, you could use the same method, but instead of replacing some of the data with another character, you just concatenate the data you want, leaving out the data you don't want.

Take a look at this documentation on anonymizing data:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Anonymizedatausingconfigurationfiles

[chinmoya]

I am using a heavy forwarder. Tried Regex and SEDCMD via props and transforms.

Not working. its still indexing the full thing.