topic bar logs with debug level enabled in Getting Data In

bar logs with debug level enabled

bmcaetano — Mon, 05 Feb 2024 01:36:59 GMT

Is there any way to block logs coming from other servers, on a distributed server, with the debug level activated? I say this because our splunk is suffering performance degradation due to the amount of DEBUG logs. I'm still studying the props.conf documentation, would this be the right way to do this?

Re: bar logs with debug level enabled

bowesmana — Mon, 05 Feb 2024 02:14:47 GMT

Take a look at Ingest Actions

Re: bar logs with debug level enabled

isoutamo — Mon, 05 Feb 2024 15:41:35 GMT

another option is use those props.conf and transforms.conf files as you already have looked. Here is one old post to do it https://community.splunk.com/t5/Monitoring-Splunk/FortiGate-Firewall-is-consuming-the-license/m-p/648680 There are lot of other examples in community and also on docs.splunk.com.

One thing what you must remember is that you must put those configurations on 1st full splunk instance from source to indexers. This could be a HF or an indexer.

r. Ismo