https://community.splunk.com/t5/Getting-Data-In/How-to-limit-the-amount-of-data-that-a-splunk-universal/m-p/249710#M48061 <P>Thank you realsplunk, that document will be useful! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 25 Aug 2016 16:55:20 GMT vvmmvvmm 2016-08-25T16:55:20Z https://community.splunk.com/t5/Getting-Data-In/How-to-limit-the-amount-of-data-that-a-splunk-universal/m-p/249706#M48057 <P>Hi there </P> <P>I am using Splunk Enterprise for security purposes...</P> <P>But ther is a lot of extraneous data in my Splunk at the moment. Looking through the dashboards I am finding a lot of performance and operational status data which I don't need. The problem is that my splunk license allows me to analyze 2gb of data in a 24 hour period. I would say that at the moment 70% of the data that goes through the system is not security related and the system was procured as a security monitoring system.</P> <P>I would like to find a way to reduce the mount of the data that the "forwarders" send back to the Splunk back end for processing. i.e. exclude all of the performance and operational data from the analysis.</P> <P>My intention is to use that freed up bandwidth to push some Anti Virus and Firewall logs to splunk instead of server performance data. </P> <P>I would really really appreciate some help with this. I have searched previous questions, but can't seem to find the answer. However, if there is a page you know of where I can find my answer please send me the link <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> </P> <P>Kind Regards</P> <P>Vera</P> Thu, 25 Aug 2016 10:14:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-limit-the-amount-of-data-that-a-splunk-universal/m-p/249706#M48057 vvmmvvmm 2016-08-25T10:14:12Z https://community.splunk.com/t5/Getting-Data-In/How-to-limit-the-amount-of-data-that-a-splunk-universal/m-p/249707#M48058 <P>Hello</P> <P>You just need to disable the inputs that you dont need, and you will stop receiving that data.</P> <P>If in the same source, there is performance and security data mixed, then you can use the null queue to avoid indexing the events that matches the patterns you define.</P> <P>Regards</P> Thu, 25 Aug 2016 14:40:09 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-limit-the-amount-of-data-that-a-splunk-universal/m-p/249707#M48058 gfuente 2016-08-25T14:40:09Z https://community.splunk.com/t5/Getting-Data-In/How-to-limit-the-amount-of-data-that-a-splunk-universal/m-p/249708#M48059 <P>Hello, look at <A href="http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Routeandfilterdatad">http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Routeandfilterdatad</A> : "Filter event data and send to queues"</P> Thu, 25 Aug 2016 14:42:27 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-limit-the-amount-of-data-that-a-splunk-universal/m-p/249708#M48059 splunkreal 2016-08-25T14:42:27Z https://community.splunk.com/t5/Getting-Data-In/How-to-limit-the-amount-of-data-that-a-splunk-universal/m-p/249709#M48060 <P>Thank you so much, appreciate your help! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 25 Aug 2016 16:54:43 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-limit-the-amount-of-data-that-a-splunk-universal/m-p/249709#M48060 vvmmvvmm 2016-08-25T16:54:43Z https://community.splunk.com/t5/Getting-Data-In/How-to-limit-the-amount-of-data-that-a-splunk-universal/m-p/249710#M48061 <P>Thank you realsplunk, that document will be useful! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 25 Aug 2016 16:55:20 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-limit-the-amount-of-data-that-a-splunk-universal/m-p/249710#M48061 vvmmvvmm 2016-08-25T16:55:20Z