- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to suppress one or two fields and associa...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to suppress one or two fields and associated values in csv file.
I have data following data in csv file. need to suppress last one or two columns. please suggest me how to do that.
1st row contains header information ,comma is delimiter
want suppress/nullify the "myField" and associated value. i tried with props.conf and transform.conf. but not working.
BusTargetId,HubId,MsgType,Priority,"Req_RespId","Source_IP","_raw","_time","command_type","endpoint_type",eventtype,gwTimestamp1,host,index,linecount,punct,source,sourcetype,"splunk_server","status_code",timestamp,"myField"
4DED32483ECD428A,100004030,Alert,2,rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7,"2001:470:b:654:225:fe8c:d410","Alert,rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7,2001:470:b:654:225:fe8c:d410,100004030,4DED32483ECD428A,ECHO,OUTAGE,2,1438432955000,,,SUCCESS, ","2020-06-12T12:08:53.000+0000",OUTAGE,ECHO,,1438432955000,uMhtVAppDPj11,"service_audit",1,",,::::::,,,,,,,,,,_","outage.txt",SMWAN,uMhtVAppDPj11,SUCCESS,none,name1
4DED32483ECD428A,100004031,Alert,2,rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7,"2001:470:b:654:225:fe8c:d410","Alert,rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7rQtuPiSZF7,2001:470:b:654:225:fe8c:d410,100004031,4DED32483ECD428A,ECHO,OUTAGE,2,1438432955000,,,SUCCESS, ","2020-06-12T12:08:53.000+0000",OUTAGE,ECHO,,1438432955000,uMhtVAppDPj11,"service_audit",1,",,::::::,,,,,,,,,,_","outage.txt",SMWAN,uMhtVAppDPj11,SUCCESS,none,name2
Appreciate your help!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As end user don't want see the newly added CSV filed and it's value.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have already indexed data , end customer added new field to the existing CSV file.
Newly added field and value should not be parsed in indexer. How to accomplish this. Please help me.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It depends on what you mean by "suppress" and what you mean by csv file. If the file is a lookup file in Splunk, you can add
| fields - myField
Or send that to outputlookup to another lookup that is shared with those who you don't want to see the last field.
If you are talking about indexing the csv, part of the configuration will have a props SED filter overwrite the data in the last column.
Index This | I’m short for "configuration file.” What am I?
New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...
Your Guide to SPL2 at .conf24!
