Indexing only partial events

[thiru25]

Hello, I have 1000s files that I am indexing but I only need first 3 fields to be indexed in each event, is there an efficient way to do this?

Here is an example: Log header with tab delimited fields, I only need to index first 3 fields "v1 Time | Datagrams | Messages" and discard other garbage.

v1 Time Datagrams Messages Total missed datagrams Total retransmission requests Total unrecognized messages Total
processed messages Total ignored messages Total invalid messages Last rx

Thanks,
Thiru.

[btt]

Hi
I think you can do it by configure file setups for index-time field extractions

When Splunk Enterprise reads file, if there are colums with empty row it does not index that header field or any of the rows in
it. This means that neither header or any of the data in its row can be searched for in the index.

So if your unwanted fieldshave empty rows(all rows) splunk would not indexed them.
You can read about Props.conf attributes for structured data in data manual.
see the MISSING_VALUE_REGEX attribute

Hope,this could help

[btt]

I find the answer below who seems similar with your question
http://answers.splunk.com/answers/42260/index-only-part-of-a-log.html

is this what you where looking for?