Refine your search:

At a high level... how would one filter the content itself being indexed.

Example: i was indexing ..say.. xml docs and wanted to exclude the contents in a pair of xml tags.

asked 13 Sep '10, 16:30

hiddenkirby's gravatar image

hiddenkirby
33916
accept rate: 14%

edited 13 Sep '10, 16:51


One Answer:

If the content will always follow a known pattern, you can use SEDCMD to filter out the text you don't want. Set the second part of the expression to be empty, e.g.: SEDCMD-abc = s/StringToThrowAway//.

Another possibility (at the event level) would be to create an entry in transforms.conf matching the information you want suppressed, and route it to a null queue. See here for an example.

link

answered 13 Sep '10, 17:38

southeringtonp's gravatar image

southeringtonp ♦
4.5k1215
accept rate: 35%

edited 14 Sep '10, 00:54

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×328
×95

Asked: 13 Sep '10, 16:30

Seen: 719 times

Last updated: 14 Sep '10, 00:54

Copyright © 2005-2012 Splunk, Inc. All rights reserved.