Splunk Data Stream Processor

Can you select & discard Information on Heavy Forwarder before forwarding to Splunk Cloud?

New Member


Not super familiar with Splunk yet but I have the following scenario.

1 - Several applications on Public Cloud Provider

2 - Heavy Forwarder deployed on Public Cloud Provider

3 - Splunk Cloud


The applications log volume on cloud is huge but not related and not wanted in the SIEM but we cannot filter data on the source itself.

Is it possible to receive the full volume on the Heavy Forwarder and the HF selects and DISCARDS data before sending to Splunk Cloud?

Or maybe we can configure HF to query the log sources for a specific string and bring only what we want?


Thank you!

Labels (3)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...