https://community.splunk.com/t5/Getting-Data-In/filtrer-inputs-heavy-forwarder/m-p/456760#M94989 <P>Thank you a lot !! </P> Fri, 05 Jul 2019 09:02:43 GMT aalaa 2019-07-05T09:02:43Z https://community.splunk.com/t5/Getting-Data-In/filtrer-inputs-heavy-forwarder/m-p/456758#M94987 <P>Hi , <BR /> How can i filter data with a heavy forwarder ? <BR /> i mean with "filter" : only index some data i need and do not send data that do not need </P> Fri, 05 Jul 2019 08:44:14 GMT https://community.splunk.com/t5/Getting-Data-In/filtrer-inputs-heavy-forwarder/m-p/456758#M94987 aalaa 2019-07-05T08:44:14Z https://community.splunk.com/t5/Getting-Data-In/filtrer-inputs-heavy-forwarder/m-p/456759#M94988 <P>Hi @aalaa,</P> <P>There are multiple way to filter data on a heavy forwarder:</P> <P>1- You can filter entire events based on keywords in those events. This is explained here :<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad">https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad</A><BR /> You can find example configurations here :<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Configure_routing">https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Configure_routing</A><BR /> And here :<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest">https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest</A></P> <P>2- You can filter parts of an event using SEDCMD. This is especially useful for anonymizing but you can also use it to get rid of useless lines in an event such as comments and descriptions in windows logs. You can find example configurations and details here :<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Anonymizedata#Anonymize_data_with_a_sed_script">https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Anonymizedata#Anonymize_data_with_a_sed_script</A></P> <P>Let me know if that helps and if you need more details.</P> <P>Cheers,<BR /> David</P> Fri, 05 Jul 2019 08:56:27 GMT https://community.splunk.com/t5/Getting-Data-In/filtrer-inputs-heavy-forwarder/m-p/456759#M94988 DavidHourani 2019-07-05T08:56:27Z https://community.splunk.com/t5/Getting-Data-In/filtrer-inputs-heavy-forwarder/m-p/456760#M94989 <P>Thank you a lot !! </P> Fri, 05 Jul 2019 09:02:43 GMT https://community.splunk.com/t5/Getting-Data-In/filtrer-inputs-heavy-forwarder/m-p/456760#M94989 aalaa 2019-07-05T09:02:43Z https://community.splunk.com/t5/Getting-Data-In/filtrer-inputs-heavy-forwarder/m-p/456761#M94990 <P>Most welcome @aalaa, let me know when you try it out if you need help ! In the meantime please accept the answer if it was helpful !</P> Fri, 05 Jul 2019 09:35:53 GMT https://community.splunk.com/t5/Getting-Data-In/filtrer-inputs-heavy-forwarder/m-p/456761#M94990 DavidHourani 2019-07-05T09:35:53Z https://community.splunk.com/t5/Getting-Data-In/filtrer-inputs-heavy-forwarder/m-p/456762#M94991 <P>I tested filtring to send log continue a keyword and it works very well , now i want to filter by discard a keyword , how can i do ?</P> Fri, 05 Jul 2019 12:50:20 GMT https://community.splunk.com/t5/Getting-Data-In/filtrer-inputs-heavy-forwarder/m-p/456762#M94991 aalaa 2019-07-05T12:50:20Z