Getting Data In

Filters on Forwarders to stay under license threshold?

Path Finder

Our servers generate many GBs of log data in one particular Windows log. Is it possible to use forwarders on each server to filter out the useless data and forward the rest to a central Splunk server for processing?

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

You can filter on the indexer and it will not count against your license. Only data that actually gets indexed will be counted. It's usually preferable to collect the data with Light Forwarders (no filtering) and filter on the indexer.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

You can filter on the indexer and it will not count against your license. Only data that actually gets indexed will be counted. It's usually preferable to collect the data with Light Forwarders (no filtering) and filter on the indexer.

View solution in original post

0 Karma