Hi,
Could you please help me to select all the fields except specified fields. My data is pipe separated.
My Data::
event1:- field1|field2|field3|field4|field5|field6|field7|field8|field9|field10|field11
event2:- field1|field2|field3|field4|field5|field6|field7|field8|field9|field10|field11
event3:- field1|field2|field3|field4|field5|field6|field7|field8|field9|field10|field11
Now I want to index only field3, field6 and field9. So for that I want to remove all remaining data before indexing.
How to select all those fields to substitute empty string with SEDCMD command in props.conf
If possible provide a link to regex101.com for testing.
Thanks
The answer to this was given to you already on your own question that was answered by woodcock here. I know your request is different from the past one, but you only need to adapt the logic from this one:
https://answers.splunk.com/answers/549535/data-filtration-at-field-level-using-sed-option.html
If you see yourself doing much more with regex in the near future you should learn about it on this neat site: