topic Re: How can i use whitelist to allow only the required data from eventlog? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-can-i-use-whitelist-to-allow-only-the-required-data-from/m-p/42535#M7939 <P>Thanks Bob! This will help with my implementation.</P> Wed, 22 May 2013 11:31:55 GMT linu1988 2013-05-22T11:31:55Z How can i use whitelist to allow only the required data from eventlog? https://community.splunk.com/t5/Getting-Data-In/How-can-i-use-whitelist-to-allow-only-the-required-data-from/m-p/42532#M7936 <P>Hello,<BR /> i would like to forward only my program related data from e.g. Program A: error occurred at step 6!!</P> <P>How can i use the whitelist and blacklist to get rid of the unnecessary event logs.</P> <P>Thanks </P> Wed, 22 May 2013 09:28:42 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-i-use-whitelist-to-allow-only-the-required-data-from/m-p/42532#M7936 linu1988 2013-05-22T09:28:42Z Re: How can i use whitelist to allow only the required data from eventlog? https://community.splunk.com/t5/Getting-Data-In/How-can-i-use-whitelist-to-allow-only-the-required-data-from/m-p/42533#M7937 <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest">http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest</A></P> Wed, 22 May 2013 09:32:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-i-use-whitelist-to-allow-only-the-required-data-from/m-p/42533#M7937 Ayn 2013-05-22T09:32:49Z Re: How can i use whitelist to allow only the required data from eventlog? https://community.splunk.com/t5/Getting-Data-In/How-can-i-use-whitelist-to-allow-only-the-required-data-from/m-p/42534#M7938 <P>Whitelists and blacklists are only used at inputs phase and match against source names, normally file names or folders. It sounds like you want to discard individual events which can not be done until parsing phase. </P> <P>This must be done on the indexer and the link Ayn provided explains how to do this.</P> Wed, 22 May 2013 10:01:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-i-use-whitelist-to-allow-only-the-required-data-from/m-p/42534#M7938 BobM 2013-05-22T10:01:33Z Re: How can i use whitelist to allow only the required data from eventlog? https://community.splunk.com/t5/Getting-Data-In/How-can-i-use-whitelist-to-allow-only-the-required-data-from/m-p/42535#M7939 <P>Thanks Bob! This will help with my implementation.</P> Wed, 22 May 2013 11:31:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-i-use-whitelist-to-allow-only-the-required-data-from/m-p/42535#M7939 linu1988 2013-05-22T11:31:55Z