Solved: How to exclude field during ingestion through DB C...

Angelt_3114 · ‎06-20-2023

Hey everyone,

I have a couple databases that are being ingested through DB Connect that have an excessive amount of fields, 300+. Some of these fields are not needed, either null or =" ", and was wondering if there is a way to exclude these before or during ingestion.

Hope everyone has an awesome day!

richgalloway · ‎06-21-2023

Instead of SELECT * FROM foo, specify the desired fields in the DBX query. If that's not feasible then use the fields command to keep only the desired fields or discard the excessive ones.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

Angelt_3114 · ‎06-21-2023

oh man! why did I not think of this? lol thank you so much! I started looking for over complicated solutions, instead of simple ones.

richgalloway · ‎06-21-2023

Instead of SELECT * FROM foo, specify the desired fields in the DBX query. If that's not feasible then use the fields command to keep only the desired fields or discard the excessive ones.

---
If this reply helps you, Karma would be appreciated.

How to exclude field during ingestion through DB Connect?

administration

troubleshooting

using Splunk Enterprise

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

Preparing your Splunk Environment for OpenSSL3

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector