https://community.splunk.com/t5/Getting-Data-In/Pre-filter-Windows-Event-Logs-before-collected/m-p/98833#M20666 <P>You can set up regular expressions to route certain data to the nullQueue, which basically means that any events that match the regular expression(s) are discarded prior to indexing and will not count against your license.</P> <P>Take a look at the following previous post on how to set this up: <A href="http://answers.splunk.com/questions/3239/try-to-route-certain-wmi-events-to-nullqueue" rel="nofollow">http://answers.splunk.com/questions/3239/try-to-route-certain-wmi-events-to-nullqueue</A></P> Fri, 03 Dec 2010 22:49:14 GMT ftk 2010-12-03T22:49:14Z https://community.splunk.com/t5/Getting-Data-In/Pre-filter-Windows-Event-Logs-before-collected/m-p/98832#M20665 <P>Is there any way to pre-filter WMI event logs, e.g. only collect warnings and errors on the Application log, System log and collect all events on the Security log? I'm trying to figure out how to reduce my index amount to control licensing costs. </P> Fri, 03 Dec 2010 22:40:14 GMT https://community.splunk.com/t5/Getting-Data-In/Pre-filter-Windows-Event-Logs-before-collected/m-p/98832#M20665 stratmark 2010-12-03T22:40:14Z https://community.splunk.com/t5/Getting-Data-In/Pre-filter-Windows-Event-Logs-before-collected/m-p/98833#M20666 <P>You can set up regular expressions to route certain data to the nullQueue, which basically means that any events that match the regular expression(s) are discarded prior to indexing and will not count against your license.</P> <P>Take a look at the following previous post on how to set this up: <A href="http://answers.splunk.com/questions/3239/try-to-route-certain-wmi-events-to-nullqueue" rel="nofollow">http://answers.splunk.com/questions/3239/try-to-route-certain-wmi-events-to-nullqueue</A></P> Fri, 03 Dec 2010 22:49:14 GMT https://community.splunk.com/t5/Getting-Data-In/Pre-filter-Windows-Event-Logs-before-collected/m-p/98833#M20666 ftk 2010-12-03T22:49:14Z