Thanks for the response.
I have been able to change the inputs.conf and blacklist the specific Event Codes in the past and it works very well, but the requirements around these Events have now changed. I am now required to store the Events long term. The solution that I am trying to push forward with is to have the Intermediate Forwarder to send to both a syslog server and the Splunk instance. This is working with the caveat that now Splunk gets the Events that I don't want as well. This is why I chose to deploy the filter at the Indexer.
Should I be able to filter these messages at the Indexer, or will it only work on the first full Splunk instance?
Thanks.
... View more