topic Re: Using Splunk on a Mac - Currently Have Over 5,000 Sources - Help! in Knowledge Management

Using Splunk on a Mac - Currently Have Over 5,000 Sources - Help!

ericrdecker — Mon, 22 Jan 2018 22:30:04 GMT

I've been using the beleaf app to develop my Splunk knowledge. I've noticed that I am unable to control the Sources and Hosts. Is there a way to limit (aside from a search query) to prevent unwanted data in my results? Thanks!!

Re: Using Splunk on a Mac - Currently Have Over 5,000 Sources - Help!

mayurr98 — Tue, 23 Jan 2018 06:31:15 GMT

hey @ericrdecker
There are two ways to do this:

1)One way to prevent unwanted data is Discard specific events and keep the rest

have a look at this doc
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest

2) Another way is to blacklist the files at index time and index only specific file you want!
Refer this doc for the same
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/Whitelistorblacklistspecificincomingdata#Blacklist_.28ignore.29_files

let me know if this helps!

Re: Using Splunk on a Mac - Currently Have Over 5,000 Sources - Help!

ericrdecker — Fri, 26 Jan 2018 16:21:50 GMT

mayurr98, Thank you for your response. I will work on this over the weekend and get back to you. Thanks!!!