I'm trying to add debug and error logs from websphere to splunk, but it consuming a lot of space. My aim is to reduce the memory consumed, so I want to avoid unnecessary logs from wbsphere to enter the splunk. All my websphere logs are first saved in system.out file which is then redirected to splunk. Please suggest if there is a way to do this.
Hi Sowmyak,
on the inputs.conf, you can add a whitelist to select the files or blacklist to filter out some files.
Let us know more info, like your current inputs.conf, to filter out filenames, etc.. so that we can help you on the inputs.conf update..
https://www.splunk.com/blog/2009/07/09/monitoring-input-files-with-a-white-list.html
http://www.splunk.com/base/Documentation/latest/Admin/WhitelistAndBlacklistRules