Splunk Enterprise

How to exclude some keyword by using mvfilter?

super_saiyan
Communicator

Hi all, 

i want to hide / delete / exclude some keyword like " supersaiyan" , "leave" from the below event using mvfilter. can anyone please tell me how to do it ?

 

| makeresults
| eval target_text="My name is supersaiyan, leave this to me"

 

Thanks

 

Labels (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

when you have normal field (not multivalue) then you can do it like

| makeresults
| fields - _time
| eval target_text="My name is supersaiyan, leave this to me"
| rex mode=sed field=target_text "s/(supersaiyan|leave)//g"

r. Ismo 

super_saiyan
Communicator

thanks for your quick response @isoutamo .

This is for testing purpose, but i do have multi field values. could you please guide me how do this same thing using mvfilter.

 

Thanks

0 Karma

isoutamo
SplunkTrust
SplunkTrust
With mvfilter you can select items which contains that regex which you are looking. It's not remove those content like above rex.
https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/MultivalueEvalFunctions#mvfilter....
0 Karma

super_saiyan
Communicator

any thoughts ? @isoutamo 

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...