All Apps and Add-ons

Splunk App for Windows Infrastructure: Is there any way to configure forwarders running on Active Directory/DNS servers to not index replicated data?

Communicator

Is there a way to configure forwarders running on AD/DNS servers not to index REPLICATED data.

For example, when an entry is removed from DNS, around 140 events are logged in Splunk from our several DNS servers and most of the data is duplicate.

alt text

0 Karma

Splunk Employee
Splunk Employee

if you can identify which data is duplicate, then the following transform will prevent the data from being indexed:

props.conf
[sourcetype]
TRANSFORMS-drop = null_queue_filter

transforms.conf
[null_queue_filter]
REGEX = <<>>
DEST_KEY = queue
FORMAT = nullQueue

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!