Getting Data In

Indexing only partial events


Hello, I have 1000s files that I am indexing but I only need first 3 fields to be indexed in each event, is there an efficient way to do this?

Here is an example: Log header with tab delimited fields, I only need to index first 3 fields "v1 Time | Datagrams | Messages" and discard other garbage.

v1 Time Datagrams Messages Total missed datagrams Total retransmission requests Total unrecognized messages Total
processed messages Total ignored messages Total invalid messages Last rx


Tags (2)
0 Karma

Path Finder

I think you can do it by configure file setups for index-time field extractions

When Splunk Enterprise reads file, if there are colums with empty row it does not index that header field or any of the rows in
it. This means that neither header or any of the data in its row can be searched for in the index.

So if your unwanted fieldshave empty rows(all rows) splunk would not indexed them.
You can read about Props.conf attributes for structured data in data manual.
see the MISSING_VALUE_REGEX attribute

Hope,this could help

0 Karma

Path Finder

I find the answer below who seems similar with your question

is this what you where looking for?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...