Getting Data In

How to exclude certain logs from indexing

vishetty
Observer

is there a way to exclude all logs being indexed for a certain field 

for eg : sourcetype=azs  container_name=moss-logger

I want my HF to filter any data being ingested from particular field (conatiner_name) with value "moss-logger"

Labels (4)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vishetty,

you can discard (and not index) data before indexing but you cannot use fields to filter them, you have to find a regex and discard all the events that match that regex.

For more infos see at https://docs.splunk.com/Documentation/Splunk/8.2.2/Forwarding/Routeandfilterdatad#Filter_event_data_...

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...