Getting Data In

Exclude Sourcetype from being indexed

himapate
Explorer

How do i exclude paticular sourcetype from being indexed at my indexer end
Or is there any method to stop them at forwarder end

0 Karma
1 Solution

gcusello
Legend

Hi himapate,
you can stop ingestion inserting disabled=1 in each stanza of your sourcetype in your forwarders inputs.conf, this is easy if you have not many Forwarders or a Deployment Server.

Otherwise, if you want to filter them on the indexers, you have to insert:
in props.conf

[your_sourcetype]
TRANSFORMS-set-nullqueue=set_nullqueue

and in transforms.conf

[set_nullqueue]
REGEX=.
DEST_KEY=queue
FORMAT=nullQueue

and restart Splunk

When you want to disable filter, you have only to comment (#) the TRANSFORMS command in props.conf (obviously restarting Splunk!).

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
Legend

Hi himapate,
you can stop ingestion inserting disabled=1 in each stanza of your sourcetype in your forwarders inputs.conf, this is easy if you have not many Forwarders or a Deployment Server.

Otherwise, if you want to filter them on the indexers, you have to insert:
in props.conf

[your_sourcetype]
TRANSFORMS-set-nullqueue=set_nullqueue

and in transforms.conf

[set_nullqueue]
REGEX=.
DEST_KEY=queue
FORMAT=nullQueue

and restart Splunk

When you want to disable filter, you have only to comment (#) the TRANSFORMS command in props.conf (obviously restarting Splunk!).

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...