Deployment Architecture

Configure Splunk to ignore logs from some VMs on the same physical host

namrithadeepak
Path Finder

Hi,

I have a setup (shown in pics) in which a bunch of forwarders are sending data to Splunk. One of the forwarders has many VMs on a single physical machine.

I would like to receive data only from vm2, and not ingest logs from vm1,3 and 4. I also want to send _internal logs from this VM to the indexer.

I do not want to touch any of the other forwarder-indexer connections.

I would preferably do it on the forwarder instead of the indexer, because the indexer is already receiving logs from other forwarders.

Please guide me, what settings should I change.

Thanks,
Namritha

alt text

Tags (1)
0 Karma

jcrabb_splunk
Splunk Employee
Splunk Employee

I would recommend reviewing the Route and Filter Data document, specifically you could route the unwanted data to the nullqueue which is discussed in that same document further down the page, HERE.

Jacob
Sr. Technical Support Engineer
0 Karma

namrithadeepak
Path Finder

Thankyou.

I would like to route events to null queue based on the source, since the source has the vm name in its format.

source=/directory to log/hostName-vmName-TypeofLog.log

How do I do the null queue routing based on the source name?

0 Karma

jcrabb_splunk
Splunk Employee
Splunk Employee

I would agree its better to not ingest the files if that is an option. If that is not an option, you can use source as outlined in the link I posted previously (HERE), it provides an example for source:

[source::/var/log/messages]
TRANSFORMS-null= setnull
Jacob
Sr. Technical Support Engineer
0 Karma

adonio
Ultra Champion

why would you like to use null queue?
if this is the path to the file you can just specify the [monitor] stanza in inputs.conf
something like this:

[monitor://directory_to_log/hostName-vm2-TypeofLog.log]
sourcetype = sourcetype
index = index

this will save you from monitoring all teh logs on the forwarder and filtering on the indexer...
hope this makes sense

0 Karma

namrithadeepak
Path Finder

Thankyou.

My requirement is specifically allows all logs except those having vm1, vm3 and vm4 in their source.
So, if source is hostname_vm1_logname, host_vm3_logname, hostname_vm4_logname, block them.

Allow all other logs to flow through.

All internal logs, and any other logs that may get added on vm2 also needs to be allowed.

Its more a problem BLOCK a few logs and ALLOW everything else.

0 Karma

gfreitas
Builder

Could you post your inputs.conf of this forwarder?

0 Karma

adonio
Ultra Champion

Hi Namritha
You can configure your inuputs.conf on this particular forwarder to monitor data from VM2 only.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...