https://community.splunk.com/t5/Getting-Data-In/Sonicwall-syslogs-and-Splunk/m-p/157096#M97985 <P>While I haven't used that myself too much yet, if you know how to distinguish an error event you'd like to index from a non-error event you'd like to discard you can set up regex-based filtering in props.conf/transforms.conf like this:</P> <PRE><CODE>props.conf [your_sonicwall_sourcetype] ... TRANSFORMS-filter = setnull,filter_for_errors transforms.conf [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [filter_for_errors] REGEX = some regular expression identifying events you want to keep DEST_KEY = queue FORMAT = parsingQueue </CODE></PRE> Fri, 12 Dec 2014 00:43:51 GMT martin_mueller 2014-12-12T00:43:51Z https://community.splunk.com/t5/Getting-Data-In/Sonicwall-syslogs-and-Splunk/m-p/157095#M97984 <P>Does anyone out there use Splunk to collect Sonicwall Syslogs? We only have the 2GB splunk license and in hardly touch that. When I turn on the Sonicwall it overloads Splunk with logs. So I'm looking for any recommendations that anyone would have to quiet this thing down. I really only care about errors, I'm not doing any log collecting for compliance or anything like that. I just like to know when things go wrong.</P> Thu, 11 Dec 2014 19:34:52 GMT https://community.splunk.com/t5/Getting-Data-In/Sonicwall-syslogs-and-Splunk/m-p/157095#M97984 franklucas30 2014-12-11T19:34:52Z https://community.splunk.com/t5/Getting-Data-In/Sonicwall-syslogs-and-Splunk/m-p/157096#M97985 <P>While I haven't used that myself too much yet, if you know how to distinguish an error event you'd like to index from a non-error event you'd like to discard you can set up regex-based filtering in props.conf/transforms.conf like this:</P> <PRE><CODE>props.conf [your_sonicwall_sourcetype] ... TRANSFORMS-filter = setnull,filter_for_errors transforms.conf [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [filter_for_errors] REGEX = some regular expression identifying events you want to keep DEST_KEY = queue FORMAT = parsingQueue </CODE></PRE> Fri, 12 Dec 2014 00:43:51 GMT https://community.splunk.com/t5/Getting-Data-In/Sonicwall-syslogs-and-Splunk/m-p/157096#M97985 martin_mueller 2014-12-12T00:43:51Z https://community.splunk.com/t5/Getting-Data-In/Sonicwall-syslogs-and-Splunk/m-p/157097#M97986 <P>I was able to figure it out, in there the log settings there is a preconfigured setting for low logging that works perfect.</P> Mon, 12 Jan 2015 20:10:44 GMT https://community.splunk.com/t5/Getting-Data-In/Sonicwall-syslogs-and-Splunk/m-p/157097#M97986 franklucas30 2015-01-12T20:10:44Z