topic Re: how to send events to nullque? in Splunk Search

how to send events to nullque?

knalla — Wed, 30 Sep 2020 04:09:51 GMT

Hi, how to exclude internal source IP events for a sourcetype (web_logs) with src_ip=10.0.0.0/8 before indexing.

Re: how to send events to nullque?

mguhad — Tue, 11 Feb 2020 09:51:21 GMT

You can eliminate unwanted data by routing it to the nullQueue and it is removed before indexing with a combination of props and tranforms .conf like below:

props.conf:

[web_logs]
TRANSFORMS-removeIP= exclude

transforms.conf:

[exclude]
REGEX = src_ip=\d{2}\.\d{1}\.\d{1}\.\d{1}\/8$
DEST_KEY = queue
FORMAT = nullQueue

For methods to keep segments of the data and discard the rest, please the docs here:https://docs.splunk.com/Documentation/Splunk/8.0.1/Forwarding/Routeandfilterdatad

Re: how to send events to nullque?

shivanshu1593 — Fri, 22 May 2020 21:56:25 GMT

You can actually save some licensing too, just by blacklisting the field, along with it's value in inputs.conf itself.

blacklist = src_ip = 10.0.0.0/8

Else, routing the data to null queue, as explained by @mguhad, will work too. I find blacklisting the data to be more helpful, when i know I don't need a portion of data at all. Why even bother to ingest it, when it has no use.