Indexing ASA logs selectively

[nooo]

Hello,

We're planning on forwarding our ASA logs to Splunk for log correlation etc, but do not want every event to be indexed. Based on the firewall event number and/or certain event strings, we'd like to selectively index some and discard the rests from indexing. What is the recommended way to deal with such a need where there's a lot of (identifiable) noise that are better suited to get discarded?

Thanks.

[_d_]

This is possible by either filtering out unwanted events or by indexing interesting events. Both accomplish the same thing but their implementation is slightly different depending on whether it's easier to enumerate unwanted or useful event strings.

More information and examples here: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad#Filter_event_data_and_...