Filter which events to be ingested

[stamatoc]

Hello everyone ,

I need to onboard a huge amount of logs which the 90% of them is unnecessary . My goal is to ingest only some keywords like "Login Failed", "User Login " etc . I have seen other articles  explaining how you can filter events by exclusion using NullQueue . But that doesn't fit in my case because I only know which event I want to ingest using particular keywords. 

I am looking forward for a hint on how can I procced on that if it's possible . 

Thank you all 😊

[isoutamo]

Hi

There are some examples on community how you can do it (e.g. https://community.splunk.com/t5/Getting-Data-In/Including-specific-incoming-data-from-monitored-log-...).

Basically 1st send all to nullQueue and then select events with your keyword and send those to indexQueue.

r. Ismo

[stamatoc]

Thank you for your fast reply , I will try to test it and come back with an output !