https://community.splunk.com/t5/Splunk-Dev/Filter-by-host-on-source-syslog/m-p/72228#M1015 <P>My scenario:</P> <UL> <LI>splunk server listening on 514/udp (syslog).</LI> <LI>many hosts/appliance send log over udp to splunk indexer.</LI> </UL> <P>My goal was:</P> <UL> <LI>filter source by ip/hostname, set custom sourcetype and index</LI> <LI>drop every upd packet not listed in my custom rules</LI> </UL> <P>What is the best way to do this?</P> <P>Regards</P> <P>bizza</P> Fri, 09 Sep 2011 10:13:07 GMT bizza 2011-09-09T10:13:07Z https://community.splunk.com/t5/Splunk-Dev/Filter-by-host-on-source-syslog/m-p/72228#M1015 <P>My scenario:</P> <UL> <LI>splunk server listening on 514/udp (syslog).</LI> <LI>many hosts/appliance send log over udp to splunk indexer.</LI> </UL> <P>My goal was:</P> <UL> <LI>filter source by ip/hostname, set custom sourcetype and index</LI> <LI>drop every upd packet not listed in my custom rules</LI> </UL> <P>What is the best way to do this?</P> <P>Regards</P> <P>bizza</P> Fri, 09 Sep 2011 10:13:07 GMT https://community.splunk.com/t5/Splunk-Dev/Filter-by-host-on-source-syslog/m-p/72228#M1015 bizza 2011-09-09T10:13:07Z https://community.splunk.com/t5/Splunk-Dev/Filter-by-host-on-source-syslog/m-p/72229#M1016 <P>Hi bizza</P> <P>you can find everything you need to know about routing and filtering data in this doc <A href="http://docs.splunk.com/Documentation/Splunk/4.2.3/Deploy/Routeandfilterdatad">here</A></P> <P>regards</P> Fri, 09 Sep 2011 12:02:38 GMT https://community.splunk.com/t5/Splunk-Dev/Filter-by-host-on-source-syslog/m-p/72229#M1016 MuS 2011-09-09T12:02:38Z