Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: filtrer inputs heavy forwarder
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi ,
How can i filter data with a heavy forwarder ?
i mean with "filter" : only index some data i need and do not send data that do not need
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @aalaa,
There are multiple way to filter data on a heavy forwarder:
1- You can filter entire events based on keywords in those events. This is explained here :
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
You can find example configurations here :
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Configure_routing
And here :
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_eve...
2- You can filter parts of an event using SEDCMD. This is especially useful for anonymizing but you can also use it to get rid of useless lines in an event such as comments and descriptions in windows logs. You can find example configurations and details here :
https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Anonymizedata#Anonymize_data_with_a_sed_scri...
Let me know if that helps and if you need more details.
Cheers,
David
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @aalaa,
There are multiple way to filter data on a heavy forwarder:
1- You can filter entire events based on keywords in those events. This is explained here :
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
You can find example configurations here :
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Configure_routing
And here :
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_eve...
2- You can filter parts of an event using SEDCMD. This is especially useful for anonymizing but you can also use it to get rid of useless lines in an event such as comments and descriptions in windows logs. You can find example configurations and details here :
https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Anonymizedata#Anonymize_data_with_a_sed_scri...
Let me know if that helps and if you need more details.
Cheers,
David
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you a lot !!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Most welcome @aalaa, let me know when you try it out if you need help ! In the meantime please accept the answer if it was helpful !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I tested filtring to send log continue a keyword and it works very well , now i want to filter by discard a keyword , how can i do ?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
