Hey guys quick question
I have my universal forwarder set on up on my box to pull my apache access.log and error.log files. Now these files are viewable no problem in the web UI but I wanna trim down what exactly it pulls out of the files. For example if i want the web ui to only display all get request from the access.log file is that possible to have the universal forwarder pre-filter everything before it even touches the indexer?
Thank a lot
Hi rodri270,
only to understand your need. do you want:
In the first case, you have to refine your search so you only see the results you want (but maintain all the logs and you can see them).
In the second case you can filter your logs on Indexers following the link https://docs.splunk.com/Documentation/Splunk/7.2.6/Forwarding/Routeandfilterdatad , in this case the logs you see in an unfiltered search are the same you indexed, and the others are lost.
Bye.
Giuseppe