How to avoid indexing of some fields or parts of events?

[jg91]

Hello, we want to filter some fields of receiving events before indexing for the license saving, for example, in a firewall traffic log we want to delete the country field in the event and index the remaining fields or parts of the event. How we can do that? Can we do that with Heavy Forwarder?

We don't want to drop any events, we just want to delete some parts of events before indexing.

[to4kawa]

https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/Whitelistorblacklistspecificincomingdata

https://docs.splunk.com/Documentation/Splunk/8.0.5/Forwarding/Routeandfilterdatad


Have you seen these?

[jg91]

Hi, yes I saw these documents, with these configs we can blacklist some sort of events, for example, we can nullQueue (or Drop) events with specific field values or strings, but I don't want to drop the event, I want to delete some fields or parts of the event before indexing, like summarization.

[isoutamo]

Hi

here is an example how it could do with props.conf https://community.splunk.com/t5/Getting-Data-In/remove-out-section-of-log/td-p/21259

r. Ismo