Can some data coming into Splunk via HTTP Event Collector be filtered to nullqueue based on sourcetype?

[simpkins1958]

When data is coming into Splunk through the HTTP Event Collector, can some of it be routed to the nullqueue based on sourcetype to avoid indexing?

http://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Routeandfilterdatad#Filter_event_data_a...

[renjith_nair · Accepted solution]

Hi @simpkins1958 ,

Yes it's possible. HEC is another input type and transformations can be applied to that as well. here is an example

props.conf

[nullq]
TRANSFORMS-set= setnull

transforms.conf

[setnull]
REGEX=.
DEST_KEY = queue
FORMAT = nullQueue

and my HEC conf from inputs.conf

[http://Test]
disabled = 0
index = main
token = myrandomtoken
sourcetype = nullq

[maciep]

I haven't done anything with http event collector myself, but I would think you could do that. I could be wrong, but it's worth trying anyway, right? I think the event collector has to be installed on a Splunk Enterprise instance, so that's probably where you would need to configure the props/transforms to do the routing.

If you need help trying to set that up, feel free to give us some more details like the sourcetype and sample events you'd like to discard.