https://community.splunk.com/t5/Getting-Data-In/On-a-syslog-light-fowarder-how-to-ignore-certain-junk-folders/m-p/175893#M35293 <P>So I have a syslog fowarder with splunk light fowarder installed.<BR /> I have a /var/syslog/* monitor statement, and also some custom ones where needed /var/syslog/servername1/* index=test etc...</P> <P>I have noticed that some users send in some real crappy data(example %hostgoeshere+timestamp) Without removing my catch all monitor statement and having a never ending task of adding new hosts.<BR /> Is there a way with the monitor statement to send this data to the null queue?<BR /> Something like</P> <PRE><CODE>[monitor:///var/syslog/%hostgoeshere*/*.log] index=null </CODE></PRE> <P>Don't see the notes anyway without having to use transforms etc... but I think this must be easier.</P> Thu, 06 Mar 2014 10:41:33 GMT Pierceyuk 2014-03-06T10:41:33Z https://community.splunk.com/t5/Getting-Data-In/On-a-syslog-light-fowarder-how-to-ignore-certain-junk-folders/m-p/175893#M35293 <P>So I have a syslog fowarder with splunk light fowarder installed.<BR /> I have a /var/syslog/* monitor statement, and also some custom ones where needed /var/syslog/servername1/* index=test etc...</P> <P>I have noticed that some users send in some real crappy data(example %hostgoeshere+timestamp) Without removing my catch all monitor statement and having a never ending task of adding new hosts.<BR /> Is there a way with the monitor statement to send this data to the null queue?<BR /> Something like</P> <PRE><CODE>[monitor:///var/syslog/%hostgoeshere*/*.log] index=null </CODE></PRE> <P>Don't see the notes anyway without having to use transforms etc... but I think this must be easier.</P> Thu, 06 Mar 2014 10:41:33 GMT https://community.splunk.com/t5/Getting-Data-In/On-a-syslog-light-fowarder-how-to-ignore-certain-junk-folders/m-p/175893#M35293 Pierceyuk 2014-03-06T10:41:33Z https://community.splunk.com/t5/Getting-Data-In/On-a-syslog-light-fowarder-how-to-ignore-certain-junk-folders/m-p/175894#M35294 <P>Have you considered setting the blacklist attribute as per <A href="http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/inputsconf">http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/inputsconf</A>?</P> Thu, 06 Mar 2014 10:55:36 GMT https://community.splunk.com/t5/Getting-Data-In/On-a-syslog-light-fowarder-how-to-ignore-certain-junk-folders/m-p/175894#M35294 martin_mueller 2014-03-06T10:55:36Z https://community.splunk.com/t5/Getting-Data-In/On-a-syslog-light-fowarder-how-to-ignore-certain-junk-folders/m-p/175895#M35295 <P>Interesting so adding something like blacklist = %hostgoeshere. would filter out all this junk?</P> Thu, 06 Mar 2014 11:07:51 GMT https://community.splunk.com/t5/Getting-Data-In/On-a-syslog-light-fowarder-how-to-ignore-certain-junk-folders/m-p/175895#M35295 Pierceyuk 2014-03-06T11:07:51Z https://community.splunk.com/t5/Getting-Data-In/On-a-syslog-light-fowarder-how-to-ignore-certain-junk-folders/m-p/175896#M35296 <P>Yup, a file will be ignored if its path matches the regex specified in a blacklist attribute. There's more info here: <A href="http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/Whitelistorblacklistspecificincomingdata">http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/Whitelistorblacklistspecificincomingdata</A></P> Thu, 06 Mar 2014 11:12:08 GMT https://community.splunk.com/t5/Getting-Data-In/On-a-syslog-light-fowarder-how-to-ignore-certain-junk-folders/m-p/175896#M35296 martin_mueller 2014-03-06T11:12:08Z