How would we extract only certain cookies from cs_cookies at indexing so we don't save all cookies?

[ryaker]

We are trying to decrease the amount of data we are indexing from iis.
We have turned on adding the cookie to the iis log for specific cookies we wish to monitor and analyze, and do not need other cookie data that is just churning through our data quota.
What would the transform be to only extract certain cookies, and not index all of cs_cookie with each iis entry?

[tiagofbmm]

Hey

Follow this guide to discard events and keep others:

http://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Routeandfilterdatad#Keep_specific_event...

[ryaker]

We don't want to discard events. We want to reduce the size of an event by only capturing some data from a given field within an event. reducing the size of the field.

[tiagofbmm]

Ok so I believe you can do a SEDCMD to replace what you don't need by nothing

https://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Anonymizedata#Define_the_sed_script_in_props...

[tiagofbmm]

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that