topic Re: How can I exclude data from being ingested by the universal forwarder? in Getting Data In

How can I exclude data from being ingested by the universal forwarder?

neophyte01 — Wed, 22 Nov 2017 17:39:15 GMT

Hello all,

I have recently set up Splunk to monitor /var/log/messages.
There is one event in this log that I would like to exclude.
The event itself really does not matter.
I would just like to know how I can keep certain types of data
from getting into Splunk, without ignoring the files which the data comes from.

Please help.

Re: How can I exclude data from being ingested by the universal forwarder?

niketn — Wed, 22 Nov 2017 20:18:01 GMT

@neophyte01, you can use nullQueue for this using transforms.conf and props.conf

Refer to documentation: http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest

Re: How can I exclude data from being ingested by the universal forwarder?

somesoni2 — Wed, 22 Nov 2017 20:28:54 GMT

And this will be configured on Indexer/Heavy forwarder, one to which your universal forwarder sends data to.

Re: How can I exclude data from being ingested by the universal forwarder?

neophyte01 — Mon, 27 Nov 2017 16:24:49 GMT

@niketnilay thanks. I believe this is what I need.

Re: How can I exclude data from being ingested by the universal forwarder?

niketn — Thu, 30 Nov 2017 14:52:59 GMT

@neophyte01, I have converted to answer. Please accept if your issue is resolved.

Re: How can I exclude data from being ingested by the universal forwarder?

bobmorning — Wed, 16 Mar 2022 12:04:26 GMT

We have an outside scanning agency that is constantly doing nmap like scans of our external perimeter. It is generating a log of log data on the perimeter CISCO firewalls. We know the IPs that the scanning is coming from; is there a way to tell the forwarders to NOT forward that log data from the firewalls for those IPs?

Thanks for any insights on this. Our Splunk SME are looking at CRIBL to do this but reading this thread makes me believe there are configuration settings that might address this?

V/R

Bob M.