https://community.splunk.com/t5/Getting-Data-In/Routing-and-filtering-syslog/m-p/538821#M90286 <P>Have Palo Alto logs being sent to syslog-ng server. A UF is on the syslog-ng and forwarding logs to Heavy Forwarder. I have a list of specific firewall (hostnames) and zones that I need to filter a copy of the traffic by and send to different (separate)&nbsp; indexer . Is it possible to filter and route using either the UF or HF?</P> Fri, 05 Feb 2021 19:38:19 GMT ezparra05 2021-02-05T19:38:19Z https://community.splunk.com/t5/Getting-Data-In/Routing-and-filtering-syslog/m-p/538821#M90286 <P>Have Palo Alto logs being sent to syslog-ng server. A UF is on the syslog-ng and forwarding logs to Heavy Forwarder. I have a list of specific firewall (hostnames) and zones that I need to filter a copy of the traffic by and send to different (separate)&nbsp; indexer . Is it possible to filter and route using either the UF or HF?</P> Fri, 05 Feb 2021 19:38:19 GMT https://community.splunk.com/t5/Getting-Data-In/Routing-and-filtering-syslog/m-p/538821#M90286 ezparra05 2021-02-05T19:38:19Z https://community.splunk.com/t5/Getting-Data-In/Routing-and-filtering-syslog/m-p/538824#M90287 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/65494">@ezparra05</a>,</P><P>You should use HF for route/filter data. Please see below document.</P><P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad</A></P><P>&nbsp;</P> Fri, 05 Feb 2021 19:49:00 GMT https://community.splunk.com/t5/Getting-Data-In/Routing-and-filtering-syslog/m-p/538824#M90287 scelikok 2021-02-05T19:49:00Z