Hi!
To save Splunk license I want to filter out some useless fields. I'we read all the log_exporter documentation and relevant posts here.
But I'm having trouble getting it to filter some fields, for examle the verbose filed "app_desc" just won't go away...
In targetConfiguration.xml I have these settings:
<format type="splunk">
<resolver>
<mappingConfiguration>MySplunkFieldsMapping.xml</mappingConfiguration>
<exportAllFields>true</exportAllFields>
</resolver>
<formatHeaderFile>MySplunkFormatDefinition.xml</formatHeaderFile>
</format>
And in MySplunkFieldsMapping.xml
<table>
<tableName>match_table</tableName>
<fields>
<field>
<origName>app_desc</origName>
<exported>false</exported>
</field>
</fields>
But that pesky add_desc fileld just wont go away.
What am I doing wrong?
