I am using Windows Host Monitoring stanza in inputs.conf like
([WinHostMon://Service] interval = 10 disabled = 0 type = Service) to collect service information on the windows machine . I got following in splunk . Type=Service Name="AeLookupSvc" DisplayName="Application Experience" Description="Processes application compatibility cache requests for applications as they are launched" Path="C:\Windows\system32\svchost.exe -k netsvcs" ServiceType="Share Process" StartMode="Manual" Started=false State="Stopped" Status="OK" ProcessId=0
I do not want to index Description and Path Field. Please suggest how I can achieve this.
In your indexing tier's
[WinHostMon] ### This affects ALL WinHostMon source types for the v6+ add-on SEDCMD-nodesc = s/([\r\n]+)Description=".+"//g SEDCMD-nopath = s/([\r\n]+)Path=".+"//g
Or to apply to only WinHostMon's Service source
[source::service] SEDCMD-nodesc = s/([\r\n]+)Description=".+"//g SEDCMD-nopath = s/([\r\n]+)Path=".+"//g
Please accept answer, if it was helpfull.
there are historic questions regarding this topic , for example