How and where do I filter logs with regex before indexing?

[SridharS]

I have a .txt log file and it has many patterns in it. I need logs of only a particular pattern. How and where can I filter them using regex?

[MuS]

Hi SridharS,

read the docs http://docs.splunk.com/Documentation/Splunk/6.3.1511/Forwarding/Routeandfilterdatad#Filter_event_dat... about Filter event data and send to queues where you can learn how this can be done. You have to do this either on the indexer or a heavy weight forwarder - don't forget to restart Splunk after the changes and it will only apply to new events.

Hope this helps ...

cheers, MuS