Hello all, THis is probably very easy or impossible in splunk, but I cant find any sufficient answers. I am trying to remove a single property from JSOn event(during parsing or I dont want it at all), e.g. I want remove "country": property and everything in it in every event which will come to splunk. Is something like that possible? I have tried some SEDCM in props.conf but no succes. Do you have any ideas? Thank you very much. { "random": 23, "random float": 28.173, "bool": false, "date": "1990-08-31", "regEx": "helloooooooooooooooooooooooooooooooooooooooooooooooooo world", "enum": "generator", "firstname": "Latisha", "lastname": "Alexandr", "city": "Tiraspol", "country": "Algeria", "countryCode": "MC", "email uses current data": "Latisha.Alexandr@gmail.com", "email from expression": "Latisha.Alexandr@yopmail.com", "array": [ "Dyann", "Christal", "Renie", "Tilly", "Margette" ], "array of objects": [ { "index": 0, "index start at 5": 5 }, { "index": 1, "index start at 5": 6 }, { "index": 2, "index start at 5": 7 } ], "Raquela": { "age": 50 } }
... View more
