https://community.splunk.com/t5/All-Apps-and-Add-ons/Skip-audit-log-by-DATABASE-USER-name/m-p/296599#M35439 <P>Hey@ksasaki0214,</P> <P>Try referring this link:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest">http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest</A></P> <P>Let me know if this helps!!</P> Sat, 31 Mar 2018 06:59:25 GMT deepashri_123 2018-03-31T06:59:25Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Skip-audit-log-by-DATABASE-USER-name/m-p/296598#M35438 <P>Hi,</P> <P>I want to skip indexing audit log if DATABASE_USER match some strings.<BR /> Is there any way?</P> <P>Thanks,</P> Thu, 29 Mar 2018 07:25:22 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Skip-audit-log-by-DATABASE-USER-name/m-p/296598#M35438 ksasaki0214 2018-03-29T07:25:22Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Skip-audit-log-by-DATABASE-USER-name/m-p/296599#M35439 <P>Hey@ksasaki0214,</P> <P>Try referring this link:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest">http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest</A></P> <P>Let me know if this helps!!</P> Sat, 31 Mar 2018 06:59:25 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Skip-audit-log-by-DATABASE-USER-name/m-p/296599#M35439 deepashri_123 2018-03-31T06:59:25Z