Our servers generate many GBs of log data in one particular Windows log. Is it possible to use forwarders on each server to filter out the useless data and forward the rest to a central Splunk server for processing?
You can filter on the indexer and it will not count against your license. Only data that actually gets indexed will be counted. It's usually preferable to collect the data with Light Forwarders (no filtering) and filter on the indexer.
You can filter on the indexer and it will not count against your license. Only data that actually gets indexed will be counted. It's usually preferable to collect the data with Light Forwarders (no filtering) and filter on the indexer.
