Splunk App for VMware - Licence

[abdulhasnath]

Hi, I have installed this app and configured it using the addon. I was able to see the data, however, I am exceeding the trial licence daily limit of 2GB. Currently, I have 5GB data coming in, as a result, I cannot view anything. Can you please advise how I can reduce what is coming in from the addon? So that I can use the app and experiment if it is suitable for our needs?
Thanks
Abdul

[MoniM]

Hi @abdulhasnath ,
If you want to limit your data, you can configure props.conf and transforms.conf. You can discard unwanted data by routing it to nullQueue.
NOTE- When you filter out data in this way, the filtered data is not forwarded or added to the index at all, and doesn't count toward your indexing volume.

For detail information, you can follow the documentation here https://docs.splunk.com/Documentation/Splunk/6.0.3/Forwarding/Routeandfilterdatad#Filter_event_data_...

Hope it helps!!
Thanks