https://community.splunk.com/t5/Splunk-Search/How-and-where-do-I-filter-logs-with-regex-before-indexing/m-p/274908#M82921 <P>I have a .txt log file and it has many patterns in it. I need logs of only a particular pattern. How and where can I filter them using regex?</P> Tue, 08 Dec 2015 20:10:09 GMT SridharS 2015-12-08T20:10:09Z https://community.splunk.com/t5/Splunk-Search/How-and-where-do-I-filter-logs-with-regex-before-indexing/m-p/274908#M82921 <P>I have a .txt log file and it has many patterns in it. I need logs of only a particular pattern. How and where can I filter them using regex?</P> Tue, 08 Dec 2015 20:10:09 GMT https://community.splunk.com/t5/Splunk-Search/How-and-where-do-I-filter-logs-with-regex-before-indexing/m-p/274908#M82921 SridharS 2015-12-08T20:10:09Z https://community.splunk.com/t5/Splunk-Search/How-and-where-do-I-filter-logs-with-regex-before-indexing/m-p/274909#M82922 <P>Hi SridharS,</P> <P>read the docs <A href="http://docs.splunk.com/Documentation/Splunk/6.3.1511/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues">http://docs.splunk.com/Documentation/Splunk/6.3.1511/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues</A> about <CODE>Filter event data and send to queues</CODE> where you can learn how this can be done. You have to do this either on the indexer or a heavy weight forwarder - don't forget to restart Splunk after the changes and it will only apply to new events.</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Tue, 08 Dec 2015 20:13:15 GMT https://community.splunk.com/t5/Splunk-Search/How-and-where-do-I-filter-logs-with-regex-before-indexing/m-p/274909#M82922 MuS 2015-12-08T20:13:15Z