Hi CsungyiPepi19,
logs can be filtered only on Indexers and (when present) on Heavy Forwarders as you can see at https://docs.splunk.com/Documentation/Splunk/7.3.2/Forwarding/Routeandfilterdatad.
There's only one filter that can be applied to Universal Forwarders and it's related to wineventlogs because it's possible to apply a whitelist and/or a blacklist to the logs to ingest.
Ijn addition, avoid to put configurations in $SPLUNK_HOME/etc/system/local, but put always conf files in dedicated apps called Technical Add-ons (TAs) because in this way you can manage them with a Deployment Server, if instead you put conf files in systel local you have to manually manage them.
When you say "When I install heavy forwarders it worked deploying config files (under \etc\deploymentapps)." this means that you're using your Heavy Forwarder as a Deployment Server, but it isn't a good configuration if you have more than 50 client to manage because in this case you need a dedicated Deplyment Server.
You can find more information at https://docs.splunk.com/Documentation/Splunk/7.3.2/Updating/Aboutdeploymentserver .
Ciao.
Giuseppe
