Splunk Search

How do you discard specific fields and keep the rest?

rakeshksingh
New Member

Hi All,

Could you please let me know how to discard specific fields and keep the rest while indexing in Splunk ?

like
field 1=a
field 2 =b
field 3 = c
field 4 =d

Fields 1-3 have to be discarded and only field 4 needs to be shown in Splunk events /_raw

Thanks
Rakesh Singh

0 Karma

FrankVl
Ultra Champion

So you just want to strip of that timestamp part? I'm a little curious as to why, but still, try this in props.conf:

[kafka:topicEvent]
SEDCMD-striptimestamp = s/,"time":\d+//

https://regex101.com/r/Ecb0rZ/1

NOTE: SEDCMD takes place at indextime, but after timestamping happens, so if you use that timestamp to populate _time, that would still work.

0 Karma

FrankVl
Ultra Champion

If you want to modify your raw events (and as a result also the fields that get extracted from those at searchtime), the SEDCMD in props.conf is usually the best option.

Can you share some sample raw events and an example of the desired output? Then we can sure help you with that.

0 Karma

rakeshksingh
New Member

added the sample logs and requirement

0 Karma

493669
Super Champion

Hi @rakeshksingh,
Go through this document to Discard specific events and keep the rest
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data_...

0 Karma

rakeshksingh
New Member

It will be discarding specific events but not fields of that event.

sample logs :-

{"message":" 2017-06-12 08:32:30,585 INFO main org.apache.coyote.ajp.AjpNioProtocol - Initializing ProtocolHandler [\"ajp-nio-8009\"]","time":1497256350}

https://answers.splunk.com/storage/temp/205746-kafkadocker.jpg alt text

So i need only message fields

0 Karma

harishalipaka
Motivator

hi @rakeshksingh

try like this ..

index=summary_data where field=4
Thanks
Harish
0 Karma

rakeshksingh
New Member

thanks for query but it all the fields are in one raw event

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...