filtering

filtering

noun

The action of limiting a set of events, or fields within events, by applying criteria to them.

• In the context of forwarding, you can filter and route events to specified indexers or queues.

• In the context of searching, you can construct searches that filter search results to remove events or fields.

Certain configuration files, such as inputs.conf and serverclass.conf, provide attributes that you can use to define inclusion and exclusion filtering rules.

For more information

In the Search Manual:

• About the search processing language

In Forwarding Data:

• Route and filter data

In Updating Splunk Enterprise Instances:

• Set up client filters

In Getting Data In:

• Include or exclude specific incoming data