https://community.splunk.com/t5/Getting-Data-In/Would-like-to-block-a-specific-Source-going-to-a-Heavy-Forwarder/m-p/406008#M72023 <P>Hello Community,</P> <P><STRONG>Resources:</STRONG><BR /> - Splunk Enterprise On-Prem = v7.1.2<BR /> - F5-BIGIP = v13.1.0<BR /> - Using: F5 Analytics iApp v3.7.2RC5<BR /> - Kiwi SYSLOG (Heavy Forwarder that has a Uni. Forwarder assigned)</P> <P><STRONG>Issue:</STRONG><BR /> I'm currently getting bombarded with over 65k events every few seconds that is related to performance data for Memory/CPU, this data comes into our Indexer and is labeled as <STRONG>source=bigip.tmstats.memory_usage_stat</STRONG> I would like to drop this source from being indexed as its taking up close to 80% of my daily license right now.</P> <P><STRONG>Please Note:</STRONG> I'm not a heavy Splunk Admin person, so please be gentle.... I break easily <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Any help is greatly appreciated, thanks!</P> Tue, 29 Sep 2020 22:46:36 GMT evolutionxtinct 2020-09-29T22:46:36Z https://community.splunk.com/t5/Getting-Data-In/Would-like-to-block-a-specific-Source-going-to-a-Heavy-Forwarder/m-p/406008#M72023 <P>Hello Community,</P> <P><STRONG>Resources:</STRONG><BR /> - Splunk Enterprise On-Prem = v7.1.2<BR /> - F5-BIGIP = v13.1.0<BR /> - Using: F5 Analytics iApp v3.7.2RC5<BR /> - Kiwi SYSLOG (Heavy Forwarder that has a Uni. Forwarder assigned)</P> <P><STRONG>Issue:</STRONG><BR /> I'm currently getting bombarded with over 65k events every few seconds that is related to performance data for Memory/CPU, this data comes into our Indexer and is labeled as <STRONG>source=bigip.tmstats.memory_usage_stat</STRONG> I would like to drop this source from being indexed as its taking up close to 80% of my daily license right now.</P> <P><STRONG>Please Note:</STRONG> I'm not a heavy Splunk Admin person, so please be gentle.... I break easily <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Any help is greatly appreciated, thanks!</P> Tue, 29 Sep 2020 22:46:36 GMT https://community.splunk.com/t5/Getting-Data-In/Would-like-to-block-a-specific-Source-going-to-a-Heavy-Forwarder/m-p/406008#M72023 evolutionxtinct 2020-09-29T22:46:36Z https://community.splunk.com/t5/Getting-Data-In/Would-like-to-block-a-specific-Source-going-to-a-Heavy-Forwarder/m-p/406009#M72024 <P>Hi,</P> <P>sounds like thats an input of your F5 BIGIP app, just find the inputs,conf on your F5 app and disable the input with the source source=bigip.tmstats.memory_usage_stat</P> <P>If you can´t find it just grep for it on your CLI in $SPLUNK_HOME/splunk/etc/apps <CODE>grep -R bigip.tmstats.memory_usage_stat</CODE></P> <P>OR use btool ( in $SPLUNK_HOME/splunk/bin) type <CODE>./splunk cmd btool inputs list --debug | grep bigip*</CODE></P> <P>Also check your modular inputs for F5 <A href="https://docs.splunk.com/Documentation/AddOns/released/F5BIGIP/Configureinputs" target="_blank">https://docs.splunk.com/Documentation/AddOns/released/F5BIGIP/Configureinputs</A></P> Tue, 29 Sep 2020 22:43:25 GMT https://community.splunk.com/t5/Getting-Data-In/Would-like-to-block-a-specific-Source-going-to-a-Heavy-Forwarder/m-p/406009#M72024 dkeck 2020-09-29T22:43:25Z https://community.splunk.com/t5/Getting-Data-In/Would-like-to-block-a-specific-Source-going-to-a-Heavy-Forwarder/m-p/406010#M72025 <P>If it was helpfull please accept the answer, thank you</P> Thu, 17 Jan 2019 06:48:05 GMT https://community.splunk.com/t5/Getting-Data-In/Would-like-to-block-a-specific-Source-going-to-a-Heavy-Forwarder/m-p/406010#M72025 dkeck 2019-01-17T06:48:05Z