Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Removal of unnecessary fields BEFORE INDEX
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi all!
There is a way to prevent the indexing of unnecessary fields? i'm indexing a syslog file from a firewall so i can do this at syslog server side but if it's possible I'd rather do it in splunk.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@davidepala you can have a scripted input to push only required data/fields to Splunk.
You can also use REGEX or SEDCMD to find regular expression based pattern and replace with space.
https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata
If you have to omin entire event from being indexed you can use nullqueue
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@davidepala you can have a scripted input to push only required data/fields to Splunk.
You can also use REGEX or SEDCMD to find regular expression based pattern and replace with space.
https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata
If you have to omin entire event from being indexed you can use nullqueue
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
TOP, you've save my day! tnx man!!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@davidepala, anytime. Please accept the answer if it helped. Do let us know if you need further help 🙂
| makeresults | eval message= "Happy Splunking!!!"
What the End of Support for Splunk Add-on Builder Means for You
Solve, Learn, Repeat: New Puzzle Channel Now Live
Building Reliable Asset and Identity Frameworks in Splunk ES
