Splunk Enterprise

remove a field from the index

gitingua
Communicator

I have an event that comes to the index. 

| search index = indexname 

filed1 

field2

field3 

 

I need to write an exception that will discard the field before getting into the index

output:

| search index = indexname 

filed1 

field3 

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

ITWhisperer
SplunkTrust
SplunkTrust

If you can identify the events you don't want, you can send them to a null queue.

0 Karma

gitingua
Communicator

@ITWhisperer or so that the field values are immediately empty as soon as they get into the index

0 Karma

gitingua
Communicator

@ITWhisperer It is important for me that they do not come to the index. so that he throws them back.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Configure a null queue and direct events that you don't want to it https://docs.splunk.com/Documentation/Splunk/8.2.3/Forwarding/Routeandfilterdatad 

gitingua
Communicator

@ITWhisperer 

  1. In props.conf, set the TRANSFORMS-null attribute:
    [ActiveDirectory]
    TRANSFORMS-null= setnull
  2. Create a corresponding stanza in transforms.conf. Set DEST_KEY to "queue" and FORMAT to "nullQueue":
    [setnull]
    REGEX = \[ms-Mcs-AdmPwdExpirationTime\]
    DEST_KEY = queue
    FORMAT = nullQueue
  3. Restart Splunk Enterprise.

    field - ms-Mcs-AdmPwdExpirationTime

    Not working.  what did I indicate wrong?
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...