topic Re: How to configure sc4s (Splunk connect for syslog SC4S) to drop certain events? in Knowledge Management

How to configure sc4s (Splunk connect for syslog SC4S) to drop certain events?

Elbald97 — Mon, 16 Dec 2024 12:52:30 GMT

Hello,

I have an Splunk Connect for Syslog (SC4S) server that retrieves logs from a source and transmits them to Splunk indexers.

But in order to reduce the number of events, I want to filter the logs at the sc4s level. Note that the sc4s tool uses syslog-ng for filtering and parsing.

The use case is as follows:
when an event arrives on the sc4s server and contains an ip address of 10.9.40.245, the event is dropped.

Does anyone have any idea how to create this filter on SC4S?

Thank you.

Re: How to configure sc4s (Splunk connect for syslog SC4S) to drop certain events?

dural_yyz — Mon, 16 Dec 2024 15:33:34 GMT

Try this from the documentation.

https://splunk.github.io/splunk-connect-for-syslog/main/sources/#filtering-events-from-output

https://splunk.github.io/splunk-connect-for-syslog/main/sources/#another-example-to-drop-events-based-on-src-and-action-values-in-message

Re: How to configure sc4s (Splunk connect for syslog SC4S) to drop certain events?

Elbald97 — Wed, 18 Dec 2024 14:21:04 GMT

Thank you.

It's worked for me.