Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to Filter part of data in an event during index time

$
0
0
Hi, I have a type of following event data which is coming from forwarder. Column1=XYZ+Column2=ABC+ColumnC=GGG.... I want to remove Column2=ABC value from the event before indexing. Can help how to filter this data. The event should be indexed like Column1=XYZ+ColumnC=GGG....

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>