Getting Data In

Disabling type "Informational" with splunk for windows

New Member

I have a linux indexer. I forward with the light forwarder from about 200 windows boxes.

On the indexer I don't want it to index type=informational.

How does one go about that?

Tags (3)
0 Karma


Take a look at routing and filtering:

You will need a transforms.conf stanza to define what events to ignore and a props.conf stanza to define which sourcetype to apply it to.

You can ignore data by routing it to the nullQueue. In transforms.conf:


This will set up everything that comes in to match that REGEX (in this case Type=Information on a newline) to go to the nullQueue (basically /dev/null).

Now apply this transforms to your event logs as such in props.conf:

TRANSFORMS-SystemInfoToNull = routeInfoToNull

Not that if you're pulling via WMI you will have to apply this to the [wmi] sourcetype. If you want to route data from additional event logs just add more stanzas to props.conf.


An afterthought: There are lots of interesting events logged as informational on Windows that you might want to actually index. Service startup type changes, service start/stop events, Windows update installs come to mind.

0 Karma

Splunk Employee
Splunk Employee

It sounds like you want to tune the windows inputs for the forwarding system. See the following link for more guidance:

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...