Splunk Search

i want to exclude some field in the before indexing because i do not want to ingest fields into Splunk anymore.

New Member

Hear is the below fields we want to exclude 

  fields                                   values

action_flags                     0x8000000000000000

action_source                 from-application

app:is_saas                      no

log_forwarding_profile    Log to Panorama

serial_number                43211001234

devicegroup_level1              14

below i wrote the props and transforms.conf but its not working properly can you please help me with the answer







Labels (3)
0 Karma

Esteemed Legend

Hi @mahendra559,

The props and transforms you describe in your question is to delete events containing that fields , is this your need?

Anyway the regex you's re using doesn't seem to be correct, can you share a sample of your data?

To better understand your need, do you want:

  1. to avoid the fields extraction at search time,
  2. to not index a part of events containing the fields,
  3. to not index the full events containing those fields,

which one?


field extraction is usually (with few exceptions) at search time, this means that you continue to have the field's values in your data, but you don't need to extract fields, but anyway the informations are present in the logs.


to not index a part of events containing that fields, you can:

  • mask the values of the fields before indexing,
  • delete part of events before indexing.

you can mask the values of a field or delete a part of events using the SEDCMD command in props.conf, something like this:

SEDCMD-<class> = s/regex to anonymize/xxxxxxxxx/

as you can read at https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata


you can delete the entire events containing that fields following the instructions at https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data... that's the solution you describe (send to nullqueue).



0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...