remove a field from the index

[gitingua]

I have an event that comes to the index. 

| search index = indexname 

filed1 

field2

field3 

I need to write an exception that will discard the field before getting into the index

output:

| search index = indexname 

filed1 

field3 

[ITWhisperer]

If you can identify the events you don't want, you can send them to a null queue.

[gitingua]

@ITWhisperer or so that the field values are immediately empty as soon as they get into the index

[gitingua]

@ITWhisperer It is important for me that they do not come to the index. so that he throws them back.

[ITWhisperer · Accepted solution]

Configure a null queue and direct events that you don't want to it https://docs.splunk.com/Documentation/Splunk/8.2.3/Forwarding/Routeandfilterdatad 

[gitingua]

@ITWhisperer 

1. In props.conf, set the TRANSFORMS-null attribute:

   [ActiveDirectory]
   TRANSFORMS-null= setnull

2. Create a corresponding stanza in transforms.conf. Set DEST_KEY to "queue" and FORMAT to "nullQueue":

   [setnull]
   REGEX = \[ms-Mcs-AdmPwdExpirationTime\]
   DEST_KEY = queue
   FORMAT = nullQueue

3. Restart Splunk Enterprise.
   
   field - ms-Mcs-AdmPwdExpirationTime
   
   Not working.  what did I indicate wrong?