https://community.splunk.com/t5/Getting-Data-In/How-to-filter-input-netflow-data/m-p/604281#M105103 <P><BR />Hello</P> <P>I am setting up netflow ticket collection on splunk.</P> <P>I am a very occasional user, and I come to you ask help.</P> <P>What interests me are specific dialogs of my network infrastructure :</P> <P>src=net_A to dest=net_B or src=net_B to dest=net_A</P> <P>All the rest i don't want splunk to keep it and store it, for example net_B to net_B, net_B to net_C, .....</P> <P>I think I must use CIRDMATCH for my need, to do the filtering I think it must be done on the forwarder but not sure</P> <P>Is there any possibility of doing this ?</P> <P>My splunk infrastructure:</P> <P>splunk 8.1.1 2 Forwarder</P> <P>2 Indexer<BR />2 Search Head<BR />1 server deployment / license</P> <P><BR />thank you</P> Tue, 05 Jul 2022 16:40:48 GMT yoan 2022-07-05T16:40:48Z https://community.splunk.com/t5/Getting-Data-In/How-to-filter-input-netflow-data/m-p/604281#M105103 <P><BR />Hello</P> <P>I am setting up netflow ticket collection on splunk.</P> <P>I am a very occasional user, and I come to you ask help.</P> <P>What interests me are specific dialogs of my network infrastructure :</P> <P>src=net_A to dest=net_B or src=net_B to dest=net_A</P> <P>All the rest i don't want splunk to keep it and store it, for example net_B to net_B, net_B to net_C, .....</P> <P>I think I must use CIRDMATCH for my need, to do the filtering I think it must be done on the forwarder but not sure</P> <P>Is there any possibility of doing this ?</P> <P>My splunk infrastructure:</P> <P>splunk 8.1.1 2 Forwarder</P> <P>2 Indexer<BR />2 Search Head<BR />1 server deployment / license</P> <P><BR />thank you</P> Tue, 05 Jul 2022 16:40:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-input-netflow-data/m-p/604281#M105103 yoan 2022-07-05T16:40:48Z