Data flood protection on forwarder or indexers

[cwacha]

Our splunk universal forwarders may be configured by our customers in terms of logs they want to collect and transfer. An application that is logging very exessively could therefore drastically increase the amount of log data to be indexed.

Is there some sort of flood protection available (on indexer or heavy forwarders) to detect universal forwarders that are transferring lots of data? Actions could be blacklisting the agent for a limited time period (and redirecting its log data to the nullqueue) or generating an alert or logging an error message.

[gkanapathy]

There currently is not, though it would be a very nice enhancement request. What you could do (relatively easily) is set yourself up a realtime alert to alert you if any forwarder send more than some amount of data in the past (say) 5 minutes. You would base this on the Splunk internal metrics log. If you look at the Splunk Deployment Monitor app, you can see examples of searches that do this on a dashboard, and you should be able to create alerts using those as a guide.