Archive

filtrer inputs heavy forwarder

Path Finder

Hi ,
How can i filter data with a heavy forwarder ?
i mean with "filter" : only index some data i need and do not send data that do not need

Tags (1)
0 Karma
1 Solution

Super Champion

Hi @aalaa,

There are multiple way to filter data on a heavy forwarder:

1- You can filter entire events based on keywords in those events. This is explained here :
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
You can find example configurations here :
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Configure_routing
And here :
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_eve...

2- You can filter parts of an event using SEDCMD. This is especially useful for anonymizing but you can also use it to get rid of useless lines in an event such as comments and descriptions in windows logs. You can find example configurations and details here :
https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Anonymizedata#Anonymize_data_with_a_sed_scri...

Let me know if that helps and if you need more details.

Cheers,
David

View solution in original post

Super Champion

Hi @aalaa,

There are multiple way to filter data on a heavy forwarder:

1- You can filter entire events based on keywords in those events. This is explained here :
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
You can find example configurations here :
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Configure_routing
And here :
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_eve...

2- You can filter parts of an event using SEDCMD. This is especially useful for anonymizing but you can also use it to get rid of useless lines in an event such as comments and descriptions in windows logs. You can find example configurations and details here :
https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Anonymizedata#Anonymize_data_with_a_sed_scri...

Let me know if that helps and if you need more details.

Cheers,
David

View solution in original post

Path Finder

Thank you a lot !!

0 Karma

Super Champion

Most welcome @aalaa, let me know when you try it out if you need help ! In the meantime please accept the answer if it was helpful !

0 Karma

Path Finder

I tested filtring to send log continue a keyword and it works very well , now i want to filter by discard a keyword , how can i do ?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!