REGEX Requred – Splunk Community

Hi @richgalloway, thank you for your reply.

Apologies, I should have been a bit more descriptive.

I am trying to implement a SEDCMD in transforms.conf to reduce a single raw event’s size, specifically by removing elements that will never be used while keeping the event intact for compliance purposes.

My intent is not to extract fields but to ensure that only the necessary elements remain in the raw event. A single regex that can clean up the event by removing unused parts while leaving the required fields would be ideal.

Thanks in advance for your guidance!

Best regards,
D Alex