Hello,
Not super familiar with Splunk yet but I have the following scenario.
1 - Several applications on Public Cloud Provider
2 - Heavy Forwarder deployed on Public Cloud Provider
3 - Splunk Cloud
The applications log volume on cloud is huge but not related and not wanted in the SIEM but we cannot filter data on the source itself.
Is it possible to receive the full volume on the Heavy Forwarder and the HF selects and DISCARDS data before sending to Splunk Cloud?
Or maybe we can configure HF to query the log sources for a specific string and bring only what we want?
Thank you!
