topic Re: Splunk Routing to Non-Indexing Queue in Getting Data In

Splunk Routing to Non-Indexing Queue

DanMelar — Tue, 11 Jun 2013 16:20:11 GMT

Within Splunk, is there a way to route data to a queue that doesn't index. If so, could you turn on the ability to index that data if needed? I have a large amount of data coming in (100+GB Per Day) but have a very small license. Can this routing be done via the Splunk Server and not with a heavy forwarder?

Re: Splunk Routing to Non-Indexing Queue

bmacias84 — Tue, 11 Jun 2013 17:13:13 GMT

If I understand your question check out this post: http://splunk-base.splunk.com/answers/85943/prevent-log-events-with-specific-text-string-from-indexing?page=1&focusedAnswerId=85950#85950

Re: Splunk Routing to Non-Indexing Queue

yannK — Tue, 11 Jun 2013 17:30:39 GMT

Do not route to a non existing queue, it will simply block your indexer once full.

But you can route to the nullQueue to drop events.
http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest

Re: Splunk Routing to Non-Indexing Queue

DanMelar — Tue, 11 Jun 2013 17:31:51 GMT

I would not like to 'drop' the events, rather keep them and not index them.

Re: Splunk Routing to Non-Indexing Queue

DanMelar — Tue, 11 Jun 2013 17:32:28 GMT

I would not like to 'drop' the events, rather keep them and not index them.