https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-or-send-to-a-null-queue-windows-event-logs/m-p/125771#M25932 <P>Hi liquid,</P> <P>take a look at the docs <A href="http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/MonitorWindowsdata#Use_the_Security_event_log_to_monitor_changes_to_files" target="_blank">Use_the_Security_event_log_to_monitor_changes_to_files</A> this will provide examples on how to <CODE>blacklist</CODE> certain windows event log entries by event code.</P> <P>also good to read: <A href="http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings" target="_blank">http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings</A></P> <P>hope this helps ...</P> <P>cheers, MuS</P> Mon, 28 Sep 2020 17:35:23 GMT MuS 2020-09-28T17:35:23Z https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-or-send-to-a-null-queue-windows-event-logs/m-p/125770#M25931 <P>i'm using UF6 and I want to filter out or send to a null queue uninteresting Windows events with UF6.</P> Tue, 16 Sep 2014 06:34:53 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-or-send-to-a-null-queue-windows-event-logs/m-p/125770#M25931 liquid 2014-09-16T06:34:53Z https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-or-send-to-a-null-queue-windows-event-logs/m-p/125771#M25932 <P>Hi liquid,</P> <P>take a look at the docs <A href="http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/MonitorWindowsdata#Use_the_Security_event_log_to_monitor_changes_to_files" target="_blank">Use_the_Security_event_log_to_monitor_changes_to_files</A> this will provide examples on how to <CODE>blacklist</CODE> certain windows event log entries by event code.</P> <P>also good to read: <A href="http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings" target="_blank">http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings</A></P> <P>hope this helps ...</P> <P>cheers, MuS</P> Mon, 28 Sep 2020 17:35:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-or-send-to-a-null-queue-windows-event-logs/m-p/125771#M25932 MuS 2020-09-28T17:35:23Z https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-or-send-to-a-null-queue-windows-event-logs/m-p/125772#M25933 <P>we can filetr the unwanted traffic to be dropped by moving them to nullQueue.</P> <P>props.conf:<BR /> [source::....log...]<BR /> TRANSFORMS-debug_log = debug_log_transform</P> <P>in transforms.conf:<BR /> [debug_log_transform]<BR /> REGEX=<BR /> DEST_KEY = queue<BR /> FORMAT = nullQueue</P> <P>so the respective matched REGEX data will not be indexed and therefore it will not affect our license limit too.<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.1.3/Forwarding/Routeandfilterdatad" target="_blank">http://docs.splunk.com/Documentation/Splunk/6.1.3/Forwarding/Routeandfilterdatad</A></P> Mon, 28 Sep 2020 17:35:26 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-or-send-to-a-null-queue-windows-event-logs/m-p/125772#M25933 neelamssantosh 2020-09-28T17:35:26Z https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-or-send-to-a-null-queue-windows-event-logs/m-p/125773#M25934 <P>this only works on an indexer not on an UF as stated in the question</P> Tue, 16 Sep 2014 07:58:00 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-or-send-to-a-null-queue-windows-event-logs/m-p/125773#M25934 lcshared 2014-09-16T07:58:00Z https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-or-send-to-a-null-queue-windows-event-logs/m-p/125774#M25935 <P>Besides routing to receivers, forwarders can also filter and route data to specific queues or discard the data altogether by routing to the null queue.<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.1.3/Forwarding/Routeandfilterdatad">http://docs.splunk.com/Documentation/Splunk/6.1.3/Forwarding/Routeandfilterdatad</A></P> Tue, 16 Sep 2014 09:33:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-or-send-to-a-null-queue-windows-event-logs/m-p/125774#M25935 neelamssantosh 2014-09-16T09:33:54Z