I have a dump.json file that collects events in JSON format:
{"key":"value","key":"value","key":"value","key":"value"....}
I have no problem processing it however each line has 400 Keys and I only need 30 of them in splunk.
How can I tell the Universal forwarder to only send those 30 fields to my Indexers?
Ingesting all the 400 fields consumes a lot of resources and license.