topic Re: Filter which events to be ingested in Getting Data In

Filter which events to be ingested

stamatoc — Thu, 25 Jan 2024 08:43:56 GMT

Hello everyone ,

I need to onboard a huge amount of logs which the 90% of them is unnecessary . My goal is to ingest only some keywords like "Login Failed", "User Login " etc . I have seen other articles explaining how you can filter events by exclusion using NullQueue . But that doesn't fit in my case because I only know which event I want to ingest using particular keywords.

I am looking forward for a hint on how can I procced on that if it's possible .

Thank you all 😊

Re: Filter which events to be ingested

isoutamo — Thu, 25 Jan 2024 08:52:24 GMT

There are some examples on community how you can do it (e.g. https://community.splunk.com/t5/Getting-Data-In/Including-specific-incoming-data-from-monitored-log-files/m-p/504800).

Basically 1st send all to nullQueue and then select events with your keyword and send those to indexQueue.

r. Ismo

Re: Filter which events to be ingested

stamatoc — Thu, 25 Jan 2024 09:19:02 GMT

Thank you for your fast reply , I will try to test it and come back with an output !