Looking for a conf example and some advice on limiting API calls to not include events where a field contains or does not contain a certain value.
So my first question is:
When I configure ... /etc/apps/Splunk_TA_snow/local inputs.conf to "filter" will that discard events NOT containing the specified values from being indexed AND from the API call? I am thinking it should be filter_data = url="/*" to GET and index only events with a url that starts with "/"...
Can anyone share an example using the "Excluded properties" option excluding events with a field "url" (from [snow://syslog_transaction] where the value does not contain a url starting "/"?
Thank you
Hey Log_wrangler,
You can refer to the doc below:
http://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Routeandfilterdatad#Discard_specific_ev...
Hey Log_wrangler,
You can refer to the doc below:
http://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Routeandfilterdatad#Discard_specific_ev...
Thank you for the link, I was actually trying to use the snow ta conf only.
If that helped you can accept the answer 🙂