Filter by host on source syslog

[bizza]

My scenario:

• splunk server listening on 514/udp (syslog).
• many hosts/appliance send log over udp to splunk indexer.

My goal was:

• filter source by ip/hostname, set custom sourcetype and index
• drop every upd packet not listed in my custom rules

What is the best way to do this?

Regards

bizza

[MuS · Accepted solution]

Hi bizza

you can find everything you need to know about routing and filtering data in this doc here

regards