Getting Data In

Filter data on indexer or heavy forwarder?

rjfv8205
Path Finder

Hello, actually we don't have heavy forwarder instance.

Is it possible filter events in indexer when recieve data from UF's? How much performance affect?

Tags (1)
0 Karma

ktn01
Path Finder

Example to drop events that do not contain $LOG$:

prop.conf

 [source_event]
 TRUNCATE = 15000
 TRANSFORMS-filter = event_drop,event_take

transforms.conf

[event_drop]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[event_take]
REGEX = \$\$LOGS\$\$
DEST_KEY = queue
FORMAT = indexQueue 

Hope it help

Christian

0 Karma

rjfv8205
Path Finder

Thanks for your answer. My other question is how much performance affect if filter events directly on indexer?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...