https://community.splunk.com/t5/Getting-Data-In/How-to-set-up-universal-forwarder-to-pre-filter-information/m-p/399991#M71230 <P>Hey guys quick question </P> <P>I have my universal forwarder set on up on my box to pull my apache access.log and error.log files. Now these files are viewable no problem in the web UI but I wanna trim down what exactly it pulls out of the files. For example if i want the web ui to only display all get request from the access.log file is that possible to have the universal forwarder pre-filter everything before it even touches the indexer?</P> <P>Thank a lot</P> Thu, 30 May 2019 16:39:40 GMT rodri270 2019-05-30T16:39:40Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-up-universal-forwarder-to-pre-filter-information/m-p/399991#M71230 <P>Hey guys quick question </P> <P>I have my universal forwarder set on up on my box to pull my apache access.log and error.log files. Now these files are viewable no problem in the web UI but I wanna trim down what exactly it pulls out of the files. For example if i want the web ui to only display all get request from the access.log file is that possible to have the universal forwarder pre-filter everything before it even touches the indexer?</P> <P>Thank a lot</P> Thu, 30 May 2019 16:39:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-up-universal-forwarder-to-pre-filter-information/m-p/399991#M71230 rodri270 2019-05-30T16:39:40Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-up-universal-forwarder-to-pre-filter-information/m-p/399992#M71231 <P>Hi rodri270,<BR /> only to understand your need. do you want:</P> <UL> <LI>to index all the logs and show in a dashboard or a search only a subset of them,</LI> <LI>filter logs and index only a part of them, so the showed data are the same that were indexed.</LI> </UL> <P>In the first case, you have to refine your search so you only see the results you want (but maintain all the logs and you can see them).<BR /> In the second case you can filter your logs on Indexers following the link <A href="https://docs.splunk.com/Documentation/Splunk/7.2.6/Forwarding/Routeandfilterdatad">https://docs.splunk.com/Documentation/Splunk/7.2.6/Forwarding/Routeandfilterdatad</A> , in this case the logs you see in an unfiltered search are the same you indexed, and the others are lost.</P> <P>Bye.<BR /> Giuseppe</P> Sat, 01 Jun 2019 06:29:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-up-universal-forwarder-to-pre-filter-information/m-p/399992#M71231 gcusello 2019-06-01T06:29:17Z