filtrer inputs heavy forwarder

[aalaa]

Hi ,
How can i filter data with a heavy forwarder ?
i mean with "filter" : only index some data i need and do not send data that do not need

[DavidHourani · Accepted solution]

Hi @aalaa,

There are multiple way to filter data on a heavy forwarder:

1- You can filter entire events based on keywords in those events. This is explained here :
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
You can find example configurations here :
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Configure_routing
And here :
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_eve...

2- You can filter parts of an event using SEDCMD. This is especially useful for anonymizing but you can also use it to get rid of useless lines in an event such as comments and descriptions in windows logs. You can find example configurations and details here :
https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Anonymizedata#Anonymize_data_with_a_sed_scri...

Let me know if that helps and if you need more details.

Cheers,
David

[aalaa]

Thank you a lot !!

[DavidHourani]

Most welcome @aalaa, let me know when you try it out if you need help ! In the meantime please accept the answer if it was helpful !

[aalaa]

I tested filtring to send log continue a keyword and it works very well , now i want to filter by discard a keyword , how can i do ?