Splunk Search

SPL on configuration files

jadengoho
Builder

Hi , 

I would like to know if we can use SPL commands on configuration files to filter incoming data ?

Cause using Regex is out of option.

 

Labels (1)
Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
0 Karma

jadengoho
Builder

This is eval, could i really use to filter the events before index time without using regex?

0 Karma

jadengoho
Builder

This works 🙂
Using eval to input a index time field and identify which will be ingested or not.

jadengoho_0-1613355664770.png

 

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...