Archive

Filter data on indexer or heavy forwarder?

Explorer

Hello, actually we don't have heavy forwarder instance.

Is it possible filter events in indexer when recieve data from UF's? How much performance affect?

Tags (1)
0 Karma

Path Finder

Example to drop events that do not contain $LOG$:

prop.conf

 [source_event]
 TRUNCATE = 15000
 TRANSFORMS-filter = event_drop,event_take

transforms.conf

[event_drop]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[event_take]
REGEX = \$\$LOGS\$\$
DEST_KEY = queue
FORMAT = indexQueue 

Hope it help

Christian

0 Karma

Explorer

Thanks for your answer. My other question is how much performance affect if filter events directly on indexer?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!