https://community.splunk.com/t5/Getting-Data-In/Filter-data-on-indexer-or-heavy-forwarder/m-p/454674#M99422 <P>Hello, actually we don't have heavy forwarder instance.</P> <P>Is it possible filter events in indexer when recieve data from UF's? How much performance affect?</P> Tue, 20 Aug 2019 15:14:30 GMT rjfv8205 2019-08-20T15:14:30Z https://community.splunk.com/t5/Getting-Data-In/Filter-data-on-indexer-or-heavy-forwarder/m-p/454674#M99422 <P>Hello, actually we don't have heavy forwarder instance.</P> <P>Is it possible filter events in indexer when recieve data from UF's? How much performance affect?</P> Tue, 20 Aug 2019 15:14:30 GMT https://community.splunk.com/t5/Getting-Data-In/Filter-data-on-indexer-or-heavy-forwarder/m-p/454674#M99422 rjfv8205 2019-08-20T15:14:30Z https://community.splunk.com/t5/Getting-Data-In/Filter-data-on-indexer-or-heavy-forwarder/m-p/454675#M99423 <P>Example to drop events that do not contain <STRONG>$LOG$</STRONG>:</P> <P>prop.conf </P> <PRE><CODE> [source_event] TRUNCATE = 15000 TRANSFORMS-filter = event_drop,event_take </CODE></PRE> <P>transforms.conf</P> <PRE><CODE>[event_drop] REGEX = . DEST_KEY = queue FORMAT = nullQueue [event_take] REGEX = \$\$LOGS\$\$ DEST_KEY = queue FORMAT = indexQueue </CODE></PRE> <P>Hope it help</P> <P>Christian</P> Tue, 20 Aug 2019 15:31:51 GMT https://community.splunk.com/t5/Getting-Data-In/Filter-data-on-indexer-or-heavy-forwarder/m-p/454675#M99423 ktn01 2019-08-20T15:31:51Z https://community.splunk.com/t5/Getting-Data-In/Filter-data-on-indexer-or-heavy-forwarder/m-p/454676#M99424 <P>Thanks for your answer. My other question is how much performance affect if filter events directly on indexer?</P> Tue, 20 Aug 2019 15:42:01 GMT https://community.splunk.com/t5/Getting-Data-In/Filter-data-on-indexer-or-heavy-forwarder/m-p/454676#M99424 rjfv8205 2019-08-20T15:42:01Z