Splunk Search

How to suppress one or two fields and associated values in csv file.

lalithadevisegu
Loves-to-Learn Lots

I have data following data in  csv file. need to suppress last one or two columns. please suggest me how to do that.

1st row contains header information ,comma is delimiter 

want suppress/nullify the  "myField" and associated value. i tried with props.conf and transform.conf. but not working.

BusTargetId,HubId,MsgType,Priority,"Req_RespId","Source_IP","_raw","_time","command_type","endpoint_type",eventtype,gwTimestamp1,host,index,linecount,punct,source,sourcetype,"splunk_server","status_code",timestamp,"myField"
4DED32483ECD428A,100004030,Alert,2,rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7,"2001:470:b:654:225:fe8c:d410","Alert,rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7,2001:470:b:654:225:fe8c:d410,100004030,4DED32483ECD428A,ECHO,OUTAGE,2,1438432955000,,,SUCCESS, ","2020-06-12T12:08:53.000+0000",OUTAGE,ECHO,,1438432955000,uMhtVAppDPj11,"service_audit",1,",,::::::,,,,,,,,,,_","outage.txt",SMWAN,uMhtVAppDPj11,SUCCESS,none,name1
4DED32483ECD428A,100004031,Alert,2,rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7,"2001:470:b:654:225:fe8c:d410","Alert,rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7,2001:470:b:654:225:fe8c:d410,100004031,4DED32483ECD428A,ECHO,OUTAGE,2,1438432955000,,,SUCCESS, ","2020-06-12T12:08:53.000+0000",OUTAGE,ECHO,,1438432955000,uMhtVAppDPj11,"service_audit",1,",,::::::,,,,,,,,,,_","outage.txt",SMWAN,uMhtVAppDPj11,SUCCESS,none,name2

 

Appreciate your help!!

Labels (1)
Tags (2)
0 Karma

lalithadevisegu
Loves-to-Learn Lots

As end user don't want see the newly added CSV filed and it's value.

0 Karma

lalithadevisegu
Loves-to-Learn Lots

Have already indexed data , end customer added new field to the existing CSV file. 

 

Newly added field and value should not be parsed in indexer. How to accomplish this. Please help me.

0 Karma

landen99
Motivator

It depends on what you mean by "suppress" and what you mean by csv file.  If the file is a lookup file in Splunk, you can add 

 

| fields - myField

 

Or send that to outputlookup to another lookup that is shared with those who you don't want to see the last field.

If you are talking about indexing the csv, part of the configuration will have a props SED filter overwrite the data in the last column.

0 Karma