topic Re: How can I filter logs from being indexed in Splunk Cloud in Getting Data In

How can I filter logs from being indexed in Splunk Cloud

eddiemashayev — Sun, 06 May 2018 14:47:57 GMT

Hey all,

I want to filter logs before they are being indexed in Splunk Cloud for example, I want to filter all logs with host="test*"

How can I do that in Splunk Cloud?

Re: How can I filter logs from being indexed in Splunk Cloud

prakash007 — Sun, 06 May 2018 15:29:41 GMT

You can discard the data via nullQueue on your Intermediate/Heavy forwarder...

http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad

Re: How can I filter logs from being indexed in Splunk Cloud

eddiemashayev — Sun, 06 May 2018 15:47:56 GMT

Thanks for the reply. But I specify it few time in my question and bolded it even. I need solution in Splunk Cloud not in the level of UF or HF(Heavy forwarder).

Re: How can I filter logs from being indexed in Splunk Cloud

prakash007 — Sun, 06 May 2018 16:37:32 GMT

I guess it should be enabled with props and transforms on the indexers in Splunk Cloud(may be a support ticket)

https://www.youtube.com/watch?v=RJAaTyFHKeo&index=1&list=PL7zWAA-DF0k9xVLrl1j-lk2F74Ge3EgCZ

Re: How can I filter logs from being indexed in Splunk Cloud

woodcock — Sun, 06 May 2018 18:05:38 GMT

You need to create an app for your Indexers to send the selected events to nullQueue then you need to open a support case to submit it to for vetting, which can take a while, but it is getting better.

Re: How can I filter logs from being indexed in Splunk Cloud

eddiemashayev — Mon, 07 May 2018 08:46:38 GMT

Why this is so complicated? Just want to filter logs before indexing, it should be very simple. Are you sure there is no other way?

Re: How can I filter logs from being indexed in Splunk Cloud

eddiemashayev — Mon, 07 May 2018 08:57:29 GMT

I didn't find in Splunk App for existing application which do the same. Maybe there is some app that have this functionality?

Re: How can I filter logs from being indexed in Splunk Cloud

woodcock — Mon, 07 May 2018 11:15:34 GMT

You are overestimating what is an app; it is just a package of configuration files. Create your files, package them as an app, submit them by case to be installed on your indexers.

Re: How can I filter logs from being indexed in Splunk Cloud

eddiemashayev — Mon, 07 May 2018 14:07:58 GMT

Thanks for clarification.
I do see many documentation on how to do it on premise, but I'm working on Splunk Cloud and I can't access to the instance to change /opt/Splunk files.

Do you know for any good documentation for Splunk Cloud?