Splunk Enterprise

remove a field from the index

gitingua
Communicator

I have an event that comes to the index. 

| search index = indexname 

filed1 

field2

field3 

 

I need to write an exception that will discard the field before getting into the index

output:

| search index = indexname 

filed1 

field3 

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

ITWhisperer
SplunkTrust
SplunkTrust

If you can identify the events you don't want, you can send them to a null queue.

0 Karma

gitingua
Communicator

@ITWhisperer or so that the field values are immediately empty as soon as they get into the index

0 Karma

gitingua
Communicator

@ITWhisperer It is important for me that they do not come to the index. so that he throws them back.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Configure a null queue and direct events that you don't want to it https://docs.splunk.com/Documentation/Splunk/8.2.3/Forwarding/Routeandfilterdatad 

gitingua
Communicator

@ITWhisperer 

  1. In props.conf, set the TRANSFORMS-null attribute:
    [ActiveDirectory]
    TRANSFORMS-null= setnull
  2. Create a corresponding stanza in transforms.conf. Set DEST_KEY to "queue" and FORMAT to "nullQueue":
    [setnull]
    REGEX = \[ms-Mcs-AdmPwdExpirationTime\]
    DEST_KEY = queue
    FORMAT = nullQueue
  3. Restart Splunk Enterprise.

    field - ms-Mcs-AdmPwdExpirationTime

    Not working.  what did I indicate wrong?
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...