Splunk Enterprise

remove a field from the index

gitingua
Communicator

I have an event that comes to the index. 

| search index = indexname 

filed1 

field2

field3 

 

I need to write an exception that will discard the field before getting into the index

output:

| search index = indexname 

filed1 

field3 

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

ITWhisperer
SplunkTrust
SplunkTrust

If you can identify the events you don't want, you can send them to a null queue.

0 Karma

gitingua
Communicator

@ITWhisperer or so that the field values are immediately empty as soon as they get into the index

0 Karma

gitingua
Communicator

@ITWhisperer It is important for me that they do not come to the index. so that he throws them back.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Configure a null queue and direct events that you don't want to it https://docs.splunk.com/Documentation/Splunk/8.2.3/Forwarding/Routeandfilterdatad 

gitingua
Communicator

@ITWhisperer 

  1. In props.conf, set the TRANSFORMS-null attribute:
    [ActiveDirectory]
    TRANSFORMS-null= setnull
  2. Create a corresponding stanza in transforms.conf. Set DEST_KEY to "queue" and FORMAT to "nullQueue":
    [setnull]
    REGEX = \[ms-Mcs-AdmPwdExpirationTime\]
    DEST_KEY = queue
    FORMAT = nullQueue
  3. Restart Splunk Enterprise.

    field - ms-Mcs-AdmPwdExpirationTime

    Not working.  what did I indicate wrong?
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>