It appears Splunk should allow you to whitelist based on Type, which is the field/key where the level is sent.
I would start with:
whitelist = Type="^[1|2]"
I think you want to look at whitelisting for this. I have blacklisted certain event codes when ingesting security logs - I believe you can also perform whitelisting, that is on ingest events that meet a particular criteria.
To whitelist levels, you would need to create a whitelist regex. you should be able to mix event IDs and regex with separate lines like so:
whitelist1 = <list of eventIDs> whitelist2 = key=regex [key=regex]