Hello everyone ,
I need to onboard a huge amount of logs which the 90% of them is unnecessary . My goal is to ingest only some keywords like "Login Failed", "User Login " etc . I have seen other articles explaining how you can filter events by exclusion using NullQueue . But that doesn't fit in my case because I only know which event I want to ingest using particular keywords.
I am looking forward for a hint on how can I procced on that if it's possible .
Thank you all 😊
Hi
There are some examples on community how you can do it (e.g. https://community.splunk.com/t5/Getting-Data-In/Including-specific-incoming-data-from-monitored-log-...).
Basically 1st send all to nullQueue and then select events with your keyword and send those to indexQueue.
r. Ismo
Thank you for your fast reply , I will try to test it and come back with an output !