yep. you can add a configuration in props and transforms on the indexer to filter the events.
see nullqueue filtering
http://docs.splunk.com/Documentation/Splunk/4.3.3/Deploy/Routeandfilterdatad#Filter_event_data_and_s...
yep. you can add a configuration in props and transforms on the indexer to filter the events.
see nullqueue filtering
http://docs.splunk.com/Documentation/Splunk/4.3.3/Deploy/Routeandfilterdatad#Filter_event_data_and_s...