Getting Data In

[Forwarder] Data Filtering Issue

qkwltk
Path Finder

Hi,Guys And I'm splunk engineer.

Project progress, issues arose data that should be filtered through a splunk forwarder.
More information is shown below.

  1. light forwarder, universal forwarder in whether filtering
    : If it's not why should not on a specific technology

  2. Universal Forwarder to filter the data to be transferred through the Indexer settings

    : If it's not why should not on a specific technology

  3. Heavy Forwarder through data filtering, Forwarder installation Environment (actual commercial server) affect whether the resource
    : Occupied sure how much cpu, memory as compared to other forwarders(light, universal forwarder) ex. Content results in a specific environment of the POC ...etc

As a result, we want to get Offical Documents that Forwarder installed on the commercial server has not affected.

We have no time to do work , so I look forward to your answer assp!^^

Thanks!

Tags (1)
0 Karma

Ayn
Legend

Filtering can only be done on instances that perform parsing - in the forwarder case, only heavy forwarders do that.

Again, we can't do your work for you - if you have no time to do this, you should get someone who does.

0 Karma

Drainy
Champion

In your case, you might find paying for professional services to be useful

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...