删除json事件Splunk的属性

Question

我在splunk中有事件JSON事件，但我想删除一个键对/属性。

例如:

从JSON下面我想删除"country"; "Algeria"，从每一个事件将会到来。有可能吗?我已经在我的props.conf中尝试了类似的操作，但是没有成功。

[k8s]
INDEXED_EXTRACTIONS=JSON
TRUNCATE = 200000
SEDCMD-remove=/"country": ".*/g

       {
            "random": 23,
            "random float": 28.173,
            "bool": false,
            "date": "1990-08-31",
            "regEx": "helloooooooooooooooooooooooooooooooooooooooooooooooooo world",
            "enum": "generator",
            "firstname": "Latisha",
            "lastname": "Alexandr",
            "city": "Tiraspol",
            "country": "Algeria",
            "countryCode": "MC",
            "email uses current data": "[e-mail]",
            "email from expression": "[e-mail]",
            "array": [
                "Dyann",
                "Christal",
                "Renie",
                "Tilly",
                "Margette"
            ],
            "array of objects": [
                {
                    "index": 0,
                    "index start at 5": 5
                },
                {
                    "index": 1,
                    "index start at 5": 6
                },
                {
                    "index": 2,
                    "index start at 5": 7
                }
            ],
            "Raquela": {
                "age": 50
            }
        }

Answer 1

您的想法是正确的，但是SEDCMD是不正确的。在props.conf

中试试

SEDCMD-noAlgeria = s/"country": "Algeria",//