I want to index only specific fields like error status in an event and discard the rest. How do I set splunk to do this?
Splunk has inbuilt functionality by filtering events by sending them to a queue called the nullQueue, which builds on the same concept as /dev/null in UNIX. This works on a per-event basis though, not internally WITHIN events, so your two options as I see it are:
The license counts against how much data is indexed. So, any way you remove data before being indexed results in less data indexed and so results in less data being counted against your license limit.
yea but anonymizing wont send it to null queue right? I dont want them counting to my indexing volume