Cribl Parser Question

Sanvy Ronny Sabapathee

Hiya

I have a pipeline set up from a datagen source (business events) - see attached first image

As you can see the event has fields, now I want to remove fields - source and sourcetype - no matter what I try in the "fields to remove" nothing gets removed (see output) below

I am trying to get the UI to show in red - the fields that are to be dropped

here is something even weirder - when I do "!(name.startsWith('source'))" for filter by expression - it shows me the new JSON payload but the UI still has source and sourcetype in it.

Wayne Gillo

Two suggestions:

1. Put an Eval function in that will change the unwanted fields to undefined. ie: sourcetype —> undefined, source —> undefined
2. Have you tried adding in a !source !sourcetype before the list of fields?

Wayne Gillo

Yeah, that worked for me. I defined a preprocessing pipeline that does this:

and finally in Splunk:

Sanvy Ronny Sabapathee

Thank you kindly I will give that a shot