Getting Data In

How to exclude certain logs from indexing

vishetty
Observer

is there a way to exclude all logs being indexed for a certain field 

for eg : sourcetype=azs  container_name=moss-logger

I want my HF to filter any data being ingested from particular field (conatiner_name) with value "moss-logger"

Labels (4)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vishetty,

you can discard (and not index) data before indexing but you cannot use fields to filter them, you have to find a regex and discard all the events that match that regex.

For more infos see at https://docs.splunk.com/Documentation/Splunk/8.2.2/Forwarding/Routeandfilterdatad#Filter_event_data_...

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...