About secneer

secneer · ‎10-13-2023

Thank you @richgalloway and @gcusello for the response... but those unfortunately weren't the answers I was looking for. Now I realise I may have not explained it the best I could; I apologise for that. The field that has been SEDCMD appears as an available field even if I search for data that does not have it in the logs. Say, it's been easily over 10 hours since the restart. Searching, right now, for the data of the last 15 minutes still shows that field, showing that it's in 100% of the logs of that search. That's what I don't understand/know how to fix. Thanks!

secneer · ‎10-12-2023

Hello all, I have created and applied the configuration in props.conf file: SEDCMD-XXXXX = s/XXXXXX//g The field I wanted deleted is deleted from the logs... or it appears that way. Looking at the raw logs, the field/values are not there, but once I expand it (with the tab in the upper-left corner of the log entry), the field is there...? As if that field/value pair was not deleted but hidden?? The field shows in the left-side column of "All Fields" too. Hope someone can guide/explain it - I have not been able to find an answer (if it even has one)... Thanks!

Posts	2
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎06-08-2023

Online Status	Offline
Date Last Visited	‎10-13-2023 12:06 AM

Field removed from logs but... it's still showing?

Re: Field removed from logs but... it's still show...

Field removed from logs but... it's still showing?

Are you a member of the Splunk Community?

Field removed from logs but... it's still showing?

Re: Field removed from logs but... it's still show...

Field removed from logs but... it's still showing?