topic Log filtering before indexing in Getting Data In

Log filtering before indexing

NeharikaVats — Tue, 21 Nov 2023 14:14:39 GMT

I want to filter the palo logs at the forwarder level by looking at the packet before indexing (licensing) based certain condition like... zone, firewall name (enterprise) etc

The logs come to both our UF & HF, what is the best way to achieve it.

Was looking into a few docs suggesting to apply ingest eval, is that feasible?

Can anyone please help me with this.

Re: Log filtering before indexing

ITWhisperer — Tue, 21 Nov 2023 14:45:13 GMT

You need to direct the "unwanted" events to a nullqueue

Re: Log filtering before indexing

gcusello — Tue, 21 Nov 2023 15:05:28 GMT

Hi @NeharikaVats ,

you can filter your logs before indexing following the instructions at https://docs.splunk.com/Documentation/Splunk/9.1.1/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues

You have to apply these configurations in the first Heavy Forwarder you have in your infrastructure.

Ciao.

Giuseppe