blacklist events from log file

[newbiesplunk]

Hi,
I wish to exclude certain events not to forward to indexer, as below. How to configure that? thks & rgds

.......Directory=.....
....Module=abc....

[Runals]

There are a couple ways to do that but if you could flesh out some examples of what you are talking about it would be easier to help. The closest thing to the data is generally preferred/the best. That would be done with using blacklist in an an inputs.conf on the forwarder. That would be placed in $SPLUNK_HOME/etc/system/local OR could be pushed out by a deployment server in which case they would live in $SPLUNK_HOME/etc/apps/<your app>/local/

Exclude: /var/log/foo

[monitor::///var/log]
blacklist = foo

[krish3]

I believe you are looking something like eventlog filtering.

Checkout EventLog filtering using inputs.conf here