Splunk Enterprise

How to exclude some keyword by using mvfilter?

super_saiyan
Communicator

Hi all, 

i want to hide / delete / exclude some keyword like " supersaiyan" , "leave" from the below event using mvfilter. can anyone please tell me how to do it ?

 

| makeresults
| eval target_text="My name is supersaiyan, leave this to me"

 

Thanks

 

Labels (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

when you have normal field (not multivalue) then you can do it like

| makeresults
| fields - _time
| eval target_text="My name is supersaiyan, leave this to me"
| rex mode=sed field=target_text "s/(supersaiyan|leave)//g"

r. Ismo 

super_saiyan
Communicator

thanks for your quick response @isoutamo .

This is for testing purpose, but i do have multi field values. could you please guide me how do this same thing using mvfilter.

 

Thanks

0 Karma

isoutamo
SplunkTrust
SplunkTrust
With mvfilter you can select items which contains that regex which you are looking. It's not remove those content like above rex.
https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/MultivalueEvalFunctions#mvfilter....
0 Karma

super_saiyan
Communicator

any thoughts ? @isoutamo 

0 Karma
Get Updates on the Splunk Community!

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...