Getting Data In

Hide an entry

New Member

Hello All,

I'm seeing a lot of port 68 broadcast from the WAN side. This is normal for a someone on a cable network. Is there a way that I can tell Splunk not to log these and drop the entries all together?

Thanks for your time and attention,

0 Karma

Splunk Employee
Splunk Employee

You can route data to the null queue to avoid having it stored or seen in Splunk. See the doc link below.

http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Routeandfilterdatad#Discard_specific_ev...

Legend

Or Google "Splunk filter event data null queue"

0 Karma