What are ways to optimize splunk license usage?

New Member

I'm using splunk enterprise. I need inforation on what are the ways and methods we can use to optimize splunk license.
For ex: in my log files I'm receiving Healthcheck messages frequently and I don't want to log these messages in my indexes. Inorder to stop incoming data with Healthcheck in message and response code as 200 I'm blacklisting the messages in splukds.
Similarly, What are the other methods to optimize splunk logs and use max utilization of splunk license?

Tags (1)
0 Karma


Hi @aswinkumar6,
there only one way: filter useless events before indexing.

There are only two methods to do this:

The first method is preferable because you filter at the origin and you don use network bandwidth.
The second permites to take specified events and discard the others or discard specified events and take the others; you need only to find the regex to filter them.


0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!