Can I filter logs coming from forwarders with config files under \etc\system or logs can be filtered just from heavy forwarders? I installed splunk forwarders and wanted to filter logs so I have tried to create props.conf and transforms.conf under \etc\System\local but there was no effect. When I install heavy forwarders it worked deploying config files (under \etc\deploymentapps).
↧