https://community.splunk.com/t5/Splunk-Search/Skip-lines-while-indexing/m-p/69493#M17413 <P>There is specific functionality for filtering incoming logs, so I wouldn't consider it a "hack" <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Have a look at the following docs page that explains how to achieve this: <A href="http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad#Filter_event_data_and_send_to_queues">http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad#Filter_event_data_and_send_to_queues</A></P> Fri, 10 Feb 2012 10:48:29 GMT Ayn 2012-02-10T10:48:29Z https://community.splunk.com/t5/Splunk-Search/Skip-lines-while-indexing/m-p/69492#M17412 <P>I am currently experimenting with the nmap scan output format and indexing the scan results with splunk. </P> <P>I noticed that I got a lot of lines containing "Nmap scan report for 57.57.223.255 [host down]" which means that the line does not contain any useful information for me. I would like to skip all lines containing "host down". </P> <P>Is there a hack to achieve this?</P> Fri, 10 Feb 2012 10:36:27 GMT https://community.splunk.com/t5/Splunk-Search/Skip-lines-while-indexing/m-p/69492#M17412 FRoth 2012-02-10T10:36:27Z https://community.splunk.com/t5/Splunk-Search/Skip-lines-while-indexing/m-p/69493#M17413 <P>There is specific functionality for filtering incoming logs, so I wouldn't consider it a "hack" <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Have a look at the following docs page that explains how to achieve this: <A href="http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad#Filter_event_data_and_send_to_queues">http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad#Filter_event_data_and_send_to_queues</A></P> Fri, 10 Feb 2012 10:48:29 GMT https://community.splunk.com/t5/Splunk-Search/Skip-lines-while-indexing/m-p/69493#M17413 Ayn 2012-02-10T10:48:29Z