https://community.splunk.com/t5/Deployment-Architecture/How-to-exclude-specific-events-from-single-computer-deployment/m-p/257296#M9776 <P>Similar example on SPlunk Doc <A href="http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest">http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest</A></P> <P>This can be done for <CODE>[yoursourcetype]</CODE> OR <CODE>[source::yoursource]</CODE> OR <CODE>[host::yourhost]</CODE></P> Wed, 23 Mar 2016 14:22:59 GMT somesoni2 2016-03-23T14:22:59Z https://community.splunk.com/t5/Deployment-Architecture/How-to-exclude-specific-events-from-single-computer-deployment/m-p/257294#M9774 <P>Configuration is controlled by deployment server -&gt; deployment clients. How can a specific event (by event id, or other search criteria) for a single computer be excluded?</P> <P>Recently a computer (deployment client) had a failed hard drive which resulted in over 100K messages per day. This quickly exceeded our quota. How can problem events be excluded from the configuration for a single client until the problem is resolved? Ideally only the problem events would be excluded, as we want to continue receiving all other messages which may indicate any new problems during the repair window.</P> Tue, 22 Mar 2016 23:34:25 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-exclude-specific-events-from-single-computer-deployment/m-p/257294#M9774 timcityspan 2016-03-22T23:34:25Z https://community.splunk.com/t5/Deployment-Architecture/How-to-exclude-specific-events-from-single-computer-deployment/m-p/257295#M9775 <P>Hello </P> <P>It depends if the client is a Heavy or Universal Forwarder. In any case you can accomplish this by sending those events to the null queue, using props and transforms. The only difference is, In the HF you put those configuration files on the HF, with the UF those configuration files but reside in the indexer(s). And be sure to define the props stanza for the particular host you want to filter out</P> <P>Check this answers to get examples on how to filter out the events:</P> <P><A href="https://answers.splunk.com/answers/59370/filtering-events-using-nullqueue.html">https://answers.splunk.com/answers/59370/filtering-events-using-nullqueue.html</A></P> <P>Regards</P> Wed, 23 Mar 2016 08:08:52 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-exclude-specific-events-from-single-computer-deployment/m-p/257295#M9775 gfuente 2016-03-23T08:08:52Z https://community.splunk.com/t5/Deployment-Architecture/How-to-exclude-specific-events-from-single-computer-deployment/m-p/257296#M9776 <P>Similar example on SPlunk Doc <A href="http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest">http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest</A></P> <P>This can be done for <CODE>[yoursourcetype]</CODE> OR <CODE>[source::yoursource]</CODE> OR <CODE>[host::yourhost]</CODE></P> Wed, 23 Mar 2016 14:22:59 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-exclude-specific-events-from-single-computer-deployment/m-p/257296#M9776 somesoni2 2016-03-23T14:22:59Z https://community.splunk.com/t5/Deployment-Architecture/How-to-exclude-specific-events-from-single-computer-deployment/m-p/257297#M9777 <P>It should be noted that this will only affect data after the transform is created. Any data prior to the transform was not filtered. Unfortunately this incident filled up the drive on the Splunk server, so we ended up deleting everything and starting over.</P> Wed, 23 Mar 2016 16:48:21 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-exclude-specific-events-from-single-computer-deployment/m-p/257297#M9777 timcityspan 2016-03-23T16:48:21Z