Getting Data In

Can some data coming into Splunk via HTTP Event Collector be filtered to nullqueue based on sourcetype?

Contributor

When data is coming into Splunk through the HTTP Event Collector, can some of it be routed to the nullqueue based on sourcetype to avoid indexing?

http://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Routeandfilterdatad#Filter_event_data_a...

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi @simpkins1958 ,

Yes it's possible. HEC is another input type and transformations can be applied to that as well. here is an example

props.conf

[nullq]
TRANSFORMS-set= setnull

transforms.conf

[setnull]
REGEX=.
DEST_KEY = queue
FORMAT = nullQueue

and my HEC conf from inputs.conf

[http://Test]
disabled = 0
index = main
token = myrandomtoken
sourcetype = nullq

View solution in original post

SplunkTrust
SplunkTrust

Hi @simpkins1958 ,

Yes it's possible. HEC is another input type and transformations can be applied to that as well. here is an example

props.conf

[nullq]
TRANSFORMS-set= setnull

transforms.conf

[setnull]
REGEX=.
DEST_KEY = queue
FORMAT = nullQueue

and my HEC conf from inputs.conf

[http://Test]
disabled = 0
index = main
token = myrandomtoken
sourcetype = nullq

View solution in original post

Champion

I haven't done anything with http event collector myself, but I would think you could do that. I could be wrong, but it's worth trying anyway, right? I think the event collector has to be installed on a Splunk Enterprise instance, so that's probably where you would need to configure the props/transforms to do the routing.

If you need help trying to set that up, feel free to give us some more details like the sourcetype and sample events you'd like to discard.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!