topic Re: Can I filter logs coming from forwarders with config files under \etc\system or logs can be filtered just from heavy forwarders? in Getting Data In

Can I filter logs coming from forwarders with config files under \etc\system or logs can be filtered just from heavy forwarders?

CsungyiPepi19 — Tue, 22 Oct 2019 06:57:45 GMT

Can I filter logs coming from forwarders with config files under \etc\system or logs can be filtered just from heavy forwarders? I installed splunk forwarders and wanted to filter logs so I have tried to create props.conf and transforms.conf under \etc\System\local but there was no effect. When I install heavy forwarders it worked deploying config files (under \etc\deploymentapps).

Re: Can I filter logs coming from forwarders with config files under \etc\system or logs can be filtered just from heavy forwarders?

gcusello — Tue, 22 Oct 2019 07:21:23 GMT

Hi CsungyiPepi19,
logs can be filtered only on Indexers and (when present) on Heavy Forwarders as you can see at https://docs.splunk.com/Documentation/Splunk/7.3.2/Forwarding/Routeandfilterdatad.
There's only one filter that can be applied to Universal Forwarders and it's related to wineventlogs because it's possible to apply a whitelist and/or a blacklist to the logs to ingest.

Ijn addition, avoid to put configurations in $SPLUNK_HOME/etc/system/local, but put always conf files in dedicated apps called Technical Add-ons (TAs) because in this way you can manage them with a Deployment Server, if instead you put conf files in systel local you have to manually manage them.

When you say "When I install heavy forwarders it worked deploying config files (under \etc\deploymentapps)." this means that you're using your Heavy Forwarder as a Deployment Server, but it isn't a good configuration if you have more than 50 client to manage because in this case you need a dedicated Deplyment Server.
You can find more information at https://docs.splunk.com/Documentation/Splunk/7.3.2/Updating/Aboutdeploymentserver .

Ciao.
Giuseppe

Re: Can I filter logs coming from forwarders with config files under \etc\system or logs can be filtered just from heavy forwarders?

CsungyiPepi19 — Tue, 22 Oct 2019 07:37:17 GMT

mille grazie Giuseppe!

CsP

Re: Can I filter logs coming from forwarders with config files under \etc\system or logs can be filtered just from heavy forwarders?

CsungyiPepi19 — Tue, 22 Oct 2019 07:38:23 GMT

Mille grazie Giuseppe!
CsP