I'm currently receiving an excess amount of data from the VMWare app sample below and would like to only keep a few of the fields before being indexed. Is there a way to do this?
_raw: vm-1111 501170cc-8439-1cb3-04ba-8dc34434b33c 4001 20 0 0 0 0 0 0 0 21 0 0 0 0 21
**Field Extractions:**
p_average_net_bytesRx_kiloBytesPerSecond 0
p_average_net_bytesTx_kiloBytesPerSecond 0
p_average_net_received_kiloBytesPerSecond 0
p_average_net_transmitted_kiloBytesPerSecond 0
p_average_net_usage_kiloBytesPerSecond 0
p_summation_net_broadcastRx_number 21
p_summation_net_broadcastTx_number 0
p_summation_net_droppedRx_number 0
p_summation_net_droppedTx_number 0
p_summation_net_multicastRx_number 0
p_summation_net_multicastTx_number 0
p_summation_net_packetsRx_number 21
p_summation_net_packetsTx_number 0
I'm looking to only keep these fields before being indexed (for example)
p_average_net_received_kiloBytesPerSecond 0
p_average_net_transmitted_kiloBytesPerSecond 0
p_summation_net_droppedRx_number 0
p_summation_net_droppedTx_number 0
p_summation_net_packetsRx_number 21
p_summation_net_packetsTx_number 0
↧