topic Re: How to disable a particular source temporarily? in Getting Data In

How to disable a particular source temporarily?

karthikeyansure — Fri, 25 Jul 2014 14:29:37 GMT

Hi Team,

One of the source throwing more logs and it is consuming more volume, so it leads to the license warning. So I need to the disable the source temporarily. Please help me.

Thanks is advance

Re: How to disable a particular source temporarily?

yannK — Fri, 25 Jul 2014 14:55:29 GMT

You can start to disable the input.
And when you want to re-enable it, move the old log files out of the way, to avoid having them be indexed (and causing a peak of volume for historical data)

More advanced techniques involve :

setup a filter on the eventcode (for windows event logs ,for recent forwarders only, at the forwarder level)
see http://docs.splunk.com/Documentation/Splunk/6.1.2/Data/MonitorWindowsdata#Create_advanced_filters_with_.3Ccode.3Ewhitelist.3C.2Fcode.3E_and_.3Ccode.3Eblacklist.3C.2Fcode.3E
use nullqueue filtering at the indexer level to drop some events, see http://docs.splunk.com/Documentation/Splunk/6.1.2/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest

Re: How to disable a particular source temporarily?

karthikeyansure — Sun, 27 Jul 2014 18:22:47 GMT

Hi Team,

I have tried null queue filtering opting, but eventhough after configuring the same, the indexing is occuring for that source. After configuring the null queue in the props.conf and transforms.conf, is it restart of server is required?

Thanks

Re: How to disable a particular source temporarily?

karthikeyansure — Sun, 27 Jul 2014 18:23:00 GMT

Hi Team,

Thanks

Re: How to disable a particular source temporarily?

jtacy — Sun, 27 Jul 2014 18:39:31 GMT

Yes, null queue is an index time transform so it requires a restart.

Re: How to disable a particular source temporarily?

yannK — Sun, 27 Jul 2014 23:39:58 GMT

yes of course, any indextime/inputtime configuration change in the configuration files require a restart to apply.