How do you discard specific fields and keep the rest?

[rakeshksingh]

Hi All,

Could you please let me know how to discard specific fields and keep the rest while indexing in Splunk ?

like
field 1=a
field 2 =b
field 3 = c
field 4 =d

Fields 1-3 have to be discarded and only field 4 needs to be shown in Splunk events /_raw

Thanks
Rakesh Singh

[FrankVl]

So you just want to strip of that timestamp part? I'm a little curious as to why, but still, try this in props.conf:

[kafka:topicEvent]
SEDCMD-striptimestamp = s/,"time":\d+//

https://regex101.com/r/Ecb0rZ/1

NOTE: SEDCMD takes place at indextime, but after timestamping happens, so if you use that timestamp to populate _time, that would still work.

[FrankVl]

If you want to modify your raw events (and as a result also the fields that get extracted from those at searchtime), the SEDCMD in props.conf is usually the best option.

Can you share some sample raw events and an example of the desired output? Then we can sure help you with that.

[rakeshksingh]

added the sample logs and requirement

[493669]

Hi @rakeshksingh,
Go through this document to Discard specific events and keep the rest
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data_...

[rakeshksingh]

It will be discarding specific events but not fields of that event.

sample logs :-

{"message":" 2017-06-12 08:32:30,585 INFO main org.apache.coyote.ajp.AjpNioProtocol - Initializing ProtocolHandler [\"ajp-nio-8009\"]","time":1497256350}

https://answers.splunk.com/storage/temp/205746-kafkadocker.jpg

So i need only message fields

[harishalipaka]

hi @rakeshksingh

try like this ..

index=summary_data where field=4

[rakeshksingh]

thanks for query but it all the fields are in one raw event