topic Re: Can some data coming into Splunk via HTTP Event Collector be filtered to nullqueue based on sourcetype? in Getting Data In

Can some data coming into Splunk via HTTP Event Collector be filtered to nullqueue based on sourcetype?

simpkins1958 — Wed, 06 Jul 2016 21:53:07 GMT

When data is coming into Splunk through the HTTP Event Collector, can some of it be routed to the nullqueue based on sourcetype to avoid indexing?

http://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues

Re: Can some data coming into Splunk via HTTP Event Collector be filtered to nullqueue based on sourcetype?

maciep — Thu, 07 Jul 2016 01:43:19 GMT

I haven't done anything with http event collector myself, but I would think you could do that. I could be wrong, but it's worth trying anyway, right? I think the event collector has to be installed on a Splunk Enterprise instance, so that's probably where you would need to configure the props/transforms to do the routing.

If you need help trying to set that up, feel free to give us some more details like the sourcetype and sample events you'd like to discard.

Re: Can some data coming into Splunk via HTTP Event Collector be filtered to nullqueue based on sourcetype?

renjith_nair — Thu, 07 Jul 2016 09:57:35 GMT

Hi @simpkins1958 ,

Yes it's possible. HEC is another input type and transformations can be applied to that as well. here is an example

props.conf

[nullq]
TRANSFORMS-set= setnull

transforms.conf

[setnull]
REGEX=.
DEST_KEY = queue
FORMAT = nullQueue

and my HEC conf from inputs.conf

[http://Test]
disabled = 0
index = main
token = myrandomtoken
sourcetype = nullq