How to exclude specific events from single computer (deployment client)?

[timcityspan]

Configuration is controlled by deployment server -> deployment clients. How can a specific event (by event id, or other search criteria) for a single computer be excluded?

Recently a computer (deployment client) had a failed hard drive which resulted in over 100K messages per day. This quickly exceeded our quota. How can problem events be excluded from the configuration for a single client until the problem is resolved? Ideally only the problem events would be excluded, as we want to continue receiving all other messages which may indicate any new problems during the repair window.

[gfuente]

Hello

It depends if the client is a Heavy or Universal Forwarder. In any case you can accomplish this by sending those events to the null queue, using props and transforms. The only difference is, In the HF you put those configuration files on the HF, with the UF those configuration files but reside in the indexer(s). And be sure to define the props stanza for the particular host you want to filter out

Check this answers to get examples on how to filter out the events:

https://answers.splunk.com/answers/59370/filtering-events-using-nullqueue.html

Regards

[somesoni2]

Similar example on SPlunk Doc http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_even...

This can be done for [yoursourcetype] OR [source::yoursource] OR [host::yourhost]

[timcityspan]

It should be noted that this will only affect data after the transform is created. Any data prior to the transform was not filtered. Unfortunately this incident filled up the drive on the Splunk server, so we ended up deleting everything and starting over.