SPL on configuration files

[jadengoho]

Hi , 

I would like to know if we can use SPL commands on configuration files to filter incoming data ?

Cause using Regex is out of option.

[to4kawa · Accepted solution]

https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/IngestEval

[jadengoho]

This is eval, could i really use to filter the events before index time without using regex?

[jadengoho]

This works 🙂
Using eval to input a index time field and identify which will be ingested or not.

jadengoho_0-1613355664770.png