i want to exclude some field in the before indexing because i do not want to ingest fields into Splunk anymore.

[mahendra559]

Hear is the below fields we want to exclude 

  fields                                   values

action_flags                     0x8000000000000000

action_source                 from-application

app:is_saas                      no

log_forwarding_profile    Log to Panorama

serial_number                43211001234

devicegroup_level1              14

below i wrote the props and transforms.conf but its not working properly can you please help me with the answer

props.conf

[sourcetype::pan:traffic]
TRANSFORMS-null=setnull

transforms.conf 

[setnull]
REGEX=(\d{19})|(from-\w*)|(\d[a-z]\d{16})|(\w+\s\w+\s\w+-\w+)|([L]\w+\s\w+\s\w+)|(\d{12})
DEST_KEY=queue
FORMAT=nullQueue

[gcusello]

Hi @mahendra559,

The props and transforms you describe in your question is to delete events containing that fields , is this your need?

Anyway the regex you's re using doesn't seem to be correct, can you share a sample of your data?

To better understand your need, do you want:

1. to avoid the fields extraction at search time,
2. to not index a part of events containing the fields,
3. to not index the full events containing those fields,

which one?

1)

field extraction is usually (with few exceptions) at search time, this means that you continue to have the field's values in your data, but you don't need to extract fields, but anyway the informations are present in the logs.

2)

to not index a part of events containing that fields, you can:

• mask the values of the fields before indexing,
• delete part of events before indexing.

you can mask the values of a field or delete a part of events using the SEDCMD command in props.conf, something like this:

SEDCMD-<class> = s/regex to anonymize/xxxxxxxxx/

as you can read at https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata

3)

you can delete the entire events containing that fields following the instructions at https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data... that's the solution you describe (send to nullqueue).

Ciao.

Giuseppe