NOT extracting key pair values found in a URL

[torowa]

Hi Splunkers.

Is there a way to prevent the extraction of KPV in a specific field/fields?

To explain further, a set of firewall logs contains a number of key=value pairs.
These are being extracted automatically by Splunk.

There is also (depending on the site) what appears to be key-values within the URL field.
These aren't values I am interested in extracting as they are simply part of the page served from the remote web server.

Is there any way to NOT extract these (perceived) key-values on a per field basis (for URL and other fields) as once extracted, some end up with field names matching CIM field names.

The only setting relating to this seems to be for disabling key-values extraction for an entire sourcetype, not individual fields.

Thanks.

[FrankVl]

I think you would indeed need to disable auto KV (so set KV_MODE=none) and define a suitable field extraction explicitly for that sourcetype.

Since you're mentioning firewall logs, isn't there a TA available that takes care of such things for you? I would expect that most firewall brands have a TA on splunkbase?