How to configure sc4s (Splunk connect for syslog SC4S) to drop certain events?

[Elbald97]

Hello,

I have an Splunk Connect for Syslog (SC4S) server that retrieves logs from a source and transmits them to Splunk indexers.

But in order to reduce the number of events, I want to filter the logs at the sc4s level. Note that the sc4s tool uses syslog-ng for filtering and parsing.

The use case is as follows:
when an event arrives on the sc4s server and contains an ip address of 10.9.40.245, the event is dropped.

Does anyone have any idea how to create this filter on SC4S?

Thank you.

[dural_yyz]

Try this from the documentation.

https://splunk.github.io/splunk-connect-for-syslog/main/sources/#filtering-events-from-output

https://splunk.github.io/splunk-connect-for-syslog/main/sources/#another-example-to-drop-events-base...

[Elbald97]

Thank you.

It's worked for me.