https://community.splunk.com/t5/Getting-Data-In/Cisco-logs-though-Heavy-Forwarder/m-p/529445#M89190 Hi<BR />Here is example how filter ASA logs <A href="https://community.splunk.com/t5/Getting-Data-In/Trying-to-filter-ASA-syslogs-before-indexing-to-avoid-license/m-p/283476" target="_blank">https://community.splunk.com/t5/Getting-Data-In/Trying-to-filter-ASA-syslogs-before-indexing-to-avoid-license/m-p/283476</A><BR />You must update it based on what you want exactly filter out.<BR />And you must do those filtering on HF not Indexers.<BR />r. Ismo Sun, 15 Nov 2020 10:17:48 GMT isoutamo 2020-11-15T10:17:48Z https://community.splunk.com/t5/Getting-Data-In/Cisco-logs-though-Heavy-Forwarder/m-p/529423#M89188 <P>Hello!</P><P>I'm trying to collect logs from Cisco ASA devices through Heavy Forwarder, I'm sending all Cisco ASA logs to my HF instance and then send them to indexers.</P><P>I want to parse these logs and send to indexers only VPN-event logs. How can I filter them?</P><P>Can I filter them using event types from Cisco Add-on?</P> Sat, 14 Nov 2020 21:28:43 GMT https://community.splunk.com/t5/Getting-Data-In/Cisco-logs-though-Heavy-Forwarder/m-p/529423#M89188 tmardan 2020-11-14T21:28:43Z https://community.splunk.com/t5/Getting-Data-In/Cisco-logs-though-Heavy-Forwarder/m-p/529445#M89190 Hi<BR />Here is example how filter ASA logs <A href="https://community.splunk.com/t5/Getting-Data-In/Trying-to-filter-ASA-syslogs-before-indexing-to-avoid-license/m-p/283476" target="_blank">https://community.splunk.com/t5/Getting-Data-In/Trying-to-filter-ASA-syslogs-before-indexing-to-avoid-license/m-p/283476</A><BR />You must update it based on what you want exactly filter out.<BR />And you must do those filtering on HF not Indexers.<BR />r. Ismo Sun, 15 Nov 2020 10:17:48 GMT https://community.splunk.com/t5/Getting-Data-In/Cisco-logs-though-Heavy-Forwarder/m-p/529445#M89190 isoutamo 2020-11-15T10:17:48Z