topic Re: Don't Index Certain Data in Getting Data In

Don't Index Certain Data

Kyle_Brandt — Fri, 25 Feb 2011 00:41:48 GMT

I have turned on security auditing temporarily in Windows and because of this have exceeded my indexing limit.

I was told when purchasing Splunk that you can prevent certain data from being index with filters to prevent this from happening.

How do I create one of these filters?

Re: Don't Index Certain Data

ziegfried — Fri, 25 Feb 2011 00:45:11 GMT

You can find the relevant documentation here: http://www.splunk.com/base/Documentation/4.1.7/Admin/Routeandfilterdata

You need to send those events to the nullQueue via transforms.

Re: Don't Index Certain Data

Kyle_Brandt — Fri, 25 Feb 2011 00:54:33 GMT

At zeigfried, any chance you could spoonfeed me an example for for wineventlog:security coming in via a light forwarder from certain hosts? Also confused about which props / trans files I should be editing...

Re: Don't Index Certain Data

gkanapathy — Fri, 25 Feb 2011 06:53:41 GMT

This should help with the "which files" queston: http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F but pretty much if you're using LWF, you filter on the indexer.

Re: Don't Index Certain Data

csparling — Fri, 24 May 2013 07:39:41 GMT

Is it also possible to not index certain data if you're not using a forwarder? Our setup is pretty simple in that we only have a single Splunk instance running without any forwarding. I've tried a number of times to set up Splunk to drop data based on the client IP by following the steps outlined but not having any luck!