Hello Team,
I am in New Splunk,
I am have Search head where I am applying Some filter like
**index=xyz sourcetype=xyz User=*NYZ***
So this User=*NYZ* filter , i want splunk do it for myself while getting indexed,so basically i want filter index data rather then complete data of users i am filter data to be shown for index XYZ in backend
expected output without Filter should be seeen all NYZ Users
↧