topic Restrict data to be indexed in Installation

Restrict data to be indexed

nrelihan — Wed, 08 Jun 2011 11:13:44 GMT

Hi, Im looking to find a remedy to restict the data that is being indexed by splunk to just error messages. The reason being is the data being indexed by a particular host is exceeding what my license allows. I believe there are particular config files that can be modified to do this?

Thanks

Re: Restrict data to be indexed

sdwilkerson — Wed, 08 Jun 2011 11:32:04 GMT

nrelihan,

What you are looking for is the nullQueue in Splunk. Essentially you use your parsing configs to determine what events should be deleted or preserved, depending on your situation.

You can find instructions in the docs, and there are many answers already posted that might address your specific needs.

Sean

Re: Restrict data to be indexed

nrelihan — Wed, 08 Jun 2011 13:27:22 GMT

Thats great Sean, exactly what I'm looking for, I'll have to do a bit of reading to wrap my head around it. thanks.