https://community.splunk.com/t5/Getting-Data-In/Filter-internal-events-that-get-forwarded/m-p/182023#M36476 <P>Perhaps this can be of help? Either stop forwarding the <CODE>_internal</CODE> events from the forwarders altogether with the <CODE>forwardedindex</CODE> setting in outputs.conf, or configure the logging levels for the various components through log.cfg;</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/outputsconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/outputsconf</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.0.1/Troubleshooting/WhatSplunklogsaboutitself">http://docs.splunk.com/Documentation/Splunk/6.0.1/Troubleshooting/WhatSplunklogsaboutitself</A></P> Tue, 17 Dec 2013 23:22:40 GMT kristian_kolb 2013-12-17T23:22:40Z https://community.splunk.com/t5/Getting-Data-In/Filter-internal-events-that-get-forwarded/m-p/182022#M36475 <P>My company has a lot of small, independent offices that have a handful of machines in each locations. The problem is there are literally hundreds of locations, many of them rural with low bandwidth.</P> <P>I'd like to filter what gets sent to index=_internal by the UniversalForwarder. I know that a Heavy forwarder can do that, but I've already provisioned thousands of Windows machines with Splunk and the _internal index is clogging some of the pipes. Any suggestion how to get just warnings and alerts for _internal instead of bandwidth-filling info events?</P> Tue, 17 Dec 2013 21:28:41 GMT https://community.splunk.com/t5/Getting-Data-In/Filter-internal-events-that-get-forwarded/m-p/182022#M36475 belka 2013-12-17T21:28:41Z https://community.splunk.com/t5/Getting-Data-In/Filter-internal-events-that-get-forwarded/m-p/182023#M36476 <P>Perhaps this can be of help? Either stop forwarding the <CODE>_internal</CODE> events from the forwarders altogether with the <CODE>forwardedindex</CODE> setting in outputs.conf, or configure the logging levels for the various components through log.cfg;</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/outputsconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/outputsconf</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.0.1/Troubleshooting/WhatSplunklogsaboutitself">http://docs.splunk.com/Documentation/Splunk/6.0.1/Troubleshooting/WhatSplunklogsaboutitself</A></P> Tue, 17 Dec 2013 23:22:40 GMT https://community.splunk.com/t5/Getting-Data-In/Filter-internal-events-that-get-forwarded/m-p/182023#M36476 kristian_kolb 2013-12-17T23:22:40Z