Getting Data In

How to filter specific fields in structured events in Heavy Forwarder?


Hi Gaurav

I want to know how to filter only few fields in an event and eliminate the other fields.

{ [-]
action: ALLOW
formatVersion: 1
httpRequest: { []
httpSourceId: 30gcfrxt8djgvhg4b8f074e
httpSourceName: ALB
nonTerminatingMatchingRules: [ []
rateBasedRuleList: [ []
ruleGroupList: [ []
terminatingRuleId: Default_Action
terminatingRuleType: REGULAR
timestamp: 1571993927624
webaclId: cxxxxxxxxxxxxxxxxxxxxxxxxxxx

I want only fields like action, ruleBasedRuleList, terminatingRuleType, and webaclId. How can I filter these fields in Splunk?

0 Karma