Is it possible to remove data from an event before indexing?

[rune_hellem]

I've been asked to index a new sourcetype which is a set of XML-files. The files contains a tag

<attachments>...</attachments>

which I want to skip, since it is of no value at all indexing the attachment as raw data...it just makes it harder to see the forest for all the trees.

Could this be done?

Update
Realized that the most obvious answer is "Preprocess the files, remove the tag then index the file", but still hoping that Splunk can be told to do this for me.

[rsennett_splunk · Accepted solution]

In props.conf you can use the command:
SEDCMD

http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Anonymizedatausingconfigurationfiles#Anonymiz...

This doc talks about anonymizing data using a SED script... and what it does is match a pattern and replace it in the example.
You'll do the same, but replace it with nothing... You can try the effect using the Data onboarding wizard (Add Data)

But it would be something like this:

props.conf
SEDCMD - dumpAttach = /s\[^\<]+\<\/attachments\>//g

[rune_hellem]

That did the trick!!

[rsennett_splunk]

Great! 🙂