Archive
Highlighted

filtrer inputs heavy forwarder

Path Finder

Hi ,
How can i filter data with a heavy forwarder ?
i mean with "filter" : only index some data i need and do not send data that do not need

Tags (1)
0 Karma
Highlighted

Re: filtrer inputs heavy forwarder

SplunkTrust
SplunkTrust

Hi @aalaa,

There are multiple way to filter data on a heavy forwarder:

1- You can filter entire events based on keywords in those events. This is explained here :
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
You can find example configurations here :
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Configure_routing
And here :
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_eve...

2- You can filter parts of an event using SEDCMD. This is especially useful for anonymizing but you can also use it to get rid of useless lines in an event such as comments and descriptions in windows logs. You can find example configurations and details here :
https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Anonymizedata#Anonymize_data_with_a_sed_scri...

Let me know if that helps and if you need more details.

Cheers,
David

View solution in original post

Highlighted

Re: filtrer inputs heavy forwarder

Path Finder

Thank you a lot !!

0 Karma
Highlighted

Re: filtrer inputs heavy forwarder

SplunkTrust
SplunkTrust

Most welcome @aalaa, let me know when you try it out if you need help ! In the meantime please accept the answer if it was helpful !

0 Karma
Highlighted

Re: filtrer inputs heavy forwarder

Path Finder

I tested filtring to send log continue a keyword and it works very well , now i want to filter by discard a keyword , how can i do ?

0 Karma