topic Configure Splunk to ignore logs from some VMs on the same physical host in Deployment Architecture

Configure Splunk to ignore logs from some VMs on the same physical host

namrithadeepak — Wed, 29 Mar 2017 05:17:22 GMT

Hi,

I have a setup (shown in pics) in which a bunch of forwarders are sending data to Splunk. One of the forwarders has many VMs on a single physical machine.

I would like to receive data only from vm2, and not ingest logs from vm1,3 and 4. I also want to send _internal logs from this VM to the indexer.

I do not want to touch any of the other forwarder-indexer connections.

I would preferably do it on the forwarder instead of the indexer, because the indexer is already receiving logs from other forwarders.

Please guide me, what settings should I change.

Thanks,
Namritha

Re: Configure Splunk to ignore logs from some VMs on the same physical host

gfreitas — Wed, 29 Mar 2017 07:47:22 GMT

Could you post your inputs.conf of this forwarder?

Re: Configure Splunk to ignore logs from some VMs on the same physical host

jcrabb_splunk — Wed, 29 Mar 2017 13:09:53 GMT

I would recommend reviewing the Route and Filter Data document, specifically you could route the unwanted data to the nullqueue which is discussed in that same document further down the page, HERE.

Re: Configure Splunk to ignore logs from some VMs on the same physical host

adonio — Wed, 29 Mar 2017 15:38:27 GMT

Hi Namritha
You can configure your inuputs.conf on this particular forwarder to monitor data from VM2 only.

Re: Configure Splunk to ignore logs from some VMs on the same physical host

namrithadeepak — Wed, 29 Mar 2017 16:36:25 GMT

Thankyou.

I would like to route events to null queue based on the source, since the source has the vm name in its format.

source=/directory to log/hostName-vmName-TypeofLog.log

How do I do the null queue routing based on the source name?

Re: Configure Splunk to ignore logs from some VMs on the same physical host

adonio — Wed, 29 Mar 2017 16:54:22 GMT

why would you like to use null queue?
if this is the path to the file you can just specify the [monitor] stanza in inputs.conf
something like this:

[monitor://directory_to_log/hostName-vm2-TypeofLog.log]
sourcetype = sourcetype
index = index

this will save you from monitoring all teh logs on the forwarder and filtering on the indexer...
hope this makes sense

Re: Configure Splunk to ignore logs from some VMs on the same physical host

namrithadeepak — Tue, 29 Sep 2020 13:25:35 GMT

Thankyou.

My requirement is specifically allows all logs except those having vm1, vm3 and vm4 in their source.
So, if source is hostname_vm1_logname, host_vm3_logname, hostname_vm4_logname, block them.

Allow all other logs to flow through.

All internal logs, and any other logs that may get added on vm2 also needs to be allowed.

Its more a problem BLOCK a few logs and ALLOW everything else.

Re: Configure Splunk to ignore logs from some VMs on the same physical host

jcrabb_splunk — Thu, 30 Mar 2017 12:50:20 GMT

I would agree its better to not ingest the files if that is an option. If that is not an option, you can use source as outlined in the link I posted previously (HERE), it provides an example for source:

[source::/var/log/messages]
TRANSFORMS-null= setnull