How to filter out certain log events before sending the data to a 3rd party system?

[gharpe2]

I am using Splunk to send log source data to QRadar and need to find a way to filter out certain unwanted log events. Do you know of a way to filter out unwanted log events?

FYI - I am sending the log data to QRadar via our 5 indexers.

[javiergn]

Hi,

Take a good look at this:

http://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Forwarddatatothird-partysystemsd#Forwar...

And if you need more information see this other doc too:

http://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Routeandfilterdatad