How to set up universal forwarder to pre-filter information before it get to indexer and is viable in web UI

[rodri270]

Hey guys quick question

I have my universal forwarder set on up on my box to pull my apache access.log and error.log files. Now these files are viewable no problem in the web UI but I wanna trim down what exactly it pulls out of the files. For example if i want the web ui to only display all get request from the access.log file is that possible to have the universal forwarder pre-filter everything before it even touches the indexer?

Thank a lot

[gcusello]

Hi rodri270,
only to understand your need. do you want:

• to index all the logs and show in a dashboard or a search only a subset of them,
• filter logs and index only a part of them, so the showed data are the same that were indexed.

In the first case, you have to refine your search so you only see the results you want (but maintain all the logs and you can see them).
In the second case you can filter your logs on Indexers following the link https://docs.splunk.com/Documentation/Splunk/7.2.6/Forwarding/Routeandfilterdatad , in this case the logs you see in an unfiltered search are the same you indexed, and the others are lost.

Bye.
Giuseppe