topic Splunk - Enterprise Security - Disable Splunk Web Messages in Splunk Enterprise Security

Splunk - Enterprise Security - Disable Splunk Web Messages

SMWickman — Tue, 29 Sep 2020 20:05:45 GMT

How can I selectively disable/suppress Splunk web messages? This one is quite a nuisance and quite obviously a bug of some kind:

Splunk_SA_CIM version 4.11.0 is lower than required 4.9.1
6/19/2018, 12:46:13 PM

It's starting to get a bit annoying clearing it over and over. 4.11.0 is obviously a higher version than 4.9.1 but I presume whatever is driving this message is only reading to 4.1* and interpreting that as a lower version.

Any help here would be hugely helpful!

Re: Splunk - Enterprise Security - Disable Splunk Web Messages

darrenfuller — Tue, 19 Jun 2018 17:09:21 GMT

If you are looking to get rid of those messages altogether, you could use props / transforms to get rid of those events at index time...

#props.conf 

[sourcetype-of-annoying-event]
TRANSFORMS-get_rid_of_annoying_messages = shred_useless_cim_events


#transforms.conf

[shred_useless_cim_events]
SOURCE_KEY = _raw
DEST_KEY = queue
FORMAT = nullQueue
REGEX = Splunk_SA_CIM\sversion\s4\.11\.0\sis\slower\sthan\srequired\s4\.9\.1

... These would need to be put on your indexers and / or heavy forwarders, depending on how data is coming into Splunk.