Cribl Parser Question
Sanvy Ronny Sabapathee
Posts: 2 ✭
in Stream
Hiya
I have a pipeline set up from a datagen source (business events) - see attached first image
As you can see the event has fields, now I want to remove fields - source and sourcetype - no matter what I try in the "fields to remove" nothing gets removed (see output) below
I am trying to get the UI to show in red - the fields that are to be dropped
here is something even weirder - when I do "!(name.startsWith('source'))" for filter by expression - it shows me the new JSON payload but the UI still has source and sourcetype in it.
0
Answers
-
Two suggestions:
- Put an Eval function in that will change the unwanted fields to undefined. ie: sourcetype —> undefined, source —> undefined
- Have you tried adding in a !source !sourcetype before the list of fields?
0 -
Yeah, that worked for me. I defined a preprocessing pipeline that does this:
and finally in Splunk:
0 -
Thank you kindly I will give that a shot
0