Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Filter data by condition on a heavy forwarder

$
0
0
Hello , Please i need to filter data on the heavy forwrader to eliminate some logs , Exemple : i need to ingnore logs which contains the fields TYPE=PERMIT with the PROTOCOL=HTTP it's work good to eliminate the log which contains the TYPE=PERMIT but i need to ignore just the TYPE=PERMIT with the PROTOCOL=HTTPS transforms.conf [setnull] REGEX = >PERMIT< DEST_KEY = queue FORMAT = nullQueue

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>