I am using Splunk forwarder to receive log files from multiple monitors. I need to filter events, based on a regex, from one particular monitor. Is there a way I can do that? I cannot use the RegEx in the Search filed of Splunk Web as it will apply it to the events coming from all the monitors. To be specific, my inputs.conf file has following monitors: [monitor:/// /Monitor1] disabled = false followTail = true index = myIndex whitelist = .log$ [monitor:/// /Monitor2] disabled = false followTail = true index = myIndex whitelist = .log$ Files from Monitor1 contain lines that begin with [NOTE/WARN/ERROR] and other lines that don't. I am only interested in the lines that being with [NOTE/WARN/ERROR] and want to filter out the other lines so that they don't appear in the search results on Splunk Web. Is there a way I can achieve this? ... View more