Getting Data In

Exclude Sourcetype from being indexed

Explorer

How do i exclude paticular sourcetype from being indexed at my indexer end
Or is there any method to stop them at forwarder end

0 Karma
1 Solution

Legend

Hi himapate,
you can stop ingestion inserting disabled=1 in each stanza of your sourcetype in your forwarders inputs.conf, this is easy if you have not many Forwarders or a Deployment Server.

Otherwise, if you want to filter them on the indexers, you have to insert:
in props.conf

[your_sourcetype]
TRANSFORMS-set-nullqueue=set_nullqueue

and in transforms.conf

[set_nullqueue]
REGEX=.
DEST_KEY=queue
FORMAT=nullQueue

and restart Splunk

When you want to disable filter, you have only to comment (#) the TRANSFORMS command in props.conf (obviously restarting Splunk!).

Bye.
Giuseppe

View solution in original post

0 Karma

Legend

Hi himapate,
you can stop ingestion inserting disabled=1 in each stanza of your sourcetype in your forwarders inputs.conf, this is easy if you have not many Forwarders or a Deployment Server.

Otherwise, if you want to filter them on the indexers, you have to insert:
in props.conf

[your_sourcetype]
TRANSFORMS-set-nullqueue=set_nullqueue

and in transforms.conf

[set_nullqueue]
REGEX=.
DEST_KEY=queue
FORMAT=nullQueue

and restart Splunk

When you want to disable filter, you have only to comment (#) the TRANSFORMS command in props.conf (obviously restarting Splunk!).

Bye.
Giuseppe

View solution in original post

0 Karma