You could use Heavy Forwarder or build a App for Splunk Cloud to filter your Logs. If you know, how your unnecessary Logs look like, you can filter it: add in props.conf TRANSFORMS-asa_filter_cloud = filterAsaLogs add in transforms.conf [filterAsaLogs] SOURCE_KEY = _raw DEST_KEY = queue FORMAT = nullQueue REGEX = (your regex to detect them) ... View more