App to stop unwanted logs ingestion ?

[AL3Z]

Hi,

Is there any app in Splunk base to analyze the logs in my Splunk ES to stop the unwanted logs ingestion ?

Thanks

[inventsekar]

the "unwanted logs" is a very vague term and the ES app definitely got no app to monitor this vagueness. 

as said by above reply, you should fine-tune what to ingest and what not to ingest(and send it to null-queue). 

[AL3Z]

As we are on the Splunk cloud GCP its won't supports the  null-queue.

[isoutamo]

Hi

all splunk instances should accept nullQeue. But you must define this parameter/transformation on the first full splunk instance from UF/data source to indexers. It could be HF or indexer.  
r. Ismo

[richgalloway]

Where did you learn this?  AFAIK, Splunk Enterprise and Splunk Cloud on all platforms supports null queue.

[inventsekar]

Please select the logs you wanted to ingest... fine-tune it. thats all. its very simple actually. 

or

simply, go with filesize. 

order all your ingested files by their size(in DMC----license consumed by log sources in last 24hrs dashboard)... if you see any logs in top 10, top20 which is an unwanted log file, then... remove it from inputs.conf (you may be using wildcards in inputs.conf.... if so, add a blacklist for that file)

[chris_barrett]

Short answer - no, there isn't.

Longer answer - but you could write an app to do it.

Assuming that you don't care for events of the sourcetype foo, you could set up an app on your indexers that looks like:

props.conf

[foo]
TRANSFORM-route_to_nullQueue = route_to_nullQueue

transforms.conf

[route_to_nullQueue]
INGEST_EVAL = queue := "nullQueue"

Once active, events of sourcetype foo won't be ingested and won't count towards your daily ingest license.