How can i use whitelist to allow only the required data from eventlog?

[linu1988]

Hello,
i would like to forward only my program related data from e.g. Program A: error occurred at step 6!!

How can i use the whitelist and blacklist to get rid of the unnecessary event logs.

Thanks

[Ayn · Accepted solution]

http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Routeandfilterdatad#Keep_specific_events_an...

[linu1988]

Thanks Bob! This will help with my implementation.

[BobM]

Whitelists and blacklists are only used at inputs phase and match against source names, normally file names or folders. It sounds like you want to discard individual events which can not be done until parsing phase.

This must be done on the indexer and the link Ayn provided explains how to do this.