https://community.splunk.com/t5/Getting-Data-In/filtering-syslog-from-only-one-host/m-p/108294#M22790 <P>I have multiple hosts sending syslog information to splunk via its listener. However, one of these hosts, I'd like to on retain certain information. </P> <P>Is the process the same (props.conf, transforms.conf) for filtering only a specific hosts syslog events?</P> Thu, 23 Dec 2010 05:06:41 GMT dbizzle 2010-12-23T05:06:41Z https://community.splunk.com/t5/Getting-Data-In/filtering-syslog-from-only-one-host/m-p/108294#M22790 <P>I have multiple hosts sending syslog information to splunk via its listener. However, one of these hosts, I'd like to on retain certain information. </P> <P>Is the process the same (props.conf, transforms.conf) for filtering only a specific hosts syslog events?</P> Thu, 23 Dec 2010 05:06:41 GMT https://community.splunk.com/t5/Getting-Data-In/filtering-syslog-from-only-one-host/m-p/108294#M22790 dbizzle 2010-12-23T05:06:41Z https://community.splunk.com/t5/Getting-Data-In/filtering-syslog-from-only-one-host/m-p/108295#M22791 <P>Yes, you would use this stanza header:</P> <PRE><CODE>[host::YourHost] </CODE></PRE> Wed, 27 May 2015 05:37:06 GMT https://community.splunk.com/t5/Getting-Data-In/filtering-syslog-from-only-one-host/m-p/108295#M22791 woodcock 2015-05-27T05:37:06Z