We have this scenario:
- we use splunk (free) as a remote syslog server.
- we send to splunk from multiple servers
- these servers are monitored by a PRTG monitoring system, which leaves it's monitoring activity in the syslog (like: Mar 27 10:18:04 monitored.server.com Mar 27 10:18:37 srv1 snmpd: Connection from UDP: [18.104.22.168]:54764->[22.214.171.124] )
we now would like to
- filter lines with the IP 126.96.36.199 from the syslog before we send it to splunk
- would like to prevent splunk from indexing lines with the IP 188.8.131.52 (to keep the indexing volume down)