Getting Data In

On a syslog light fowarder, how to ignore certain junk folders

Pierceyuk
Path Finder

So I have a syslog fowarder with splunk light fowarder installed.
I have a /var/syslog/* monitor statement, and also some custom ones where needed /var/syslog/servername1/* index=test etc...

I have noticed that some users send in some real crappy data(example %hostgoeshere+timestamp) Without removing my catch all monitor statement and having a never ending task of adding new hosts.
Is there a way with the monitor statement to send this data to the null queue?
Something like

[monitor:///var/syslog/%hostgoeshere*/*.log]
index=null

Don't see the notes anyway without having to use transforms etc... but I think this must be easier.

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

martin_mueller
SplunkTrust
SplunkTrust

Have you considered setting the blacklist attribute as per http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/inputsconf?

martin_mueller
SplunkTrust
SplunkTrust

Yup, a file will be ignored if its path matches the regex specified in a blacklist attribute. There's more info here: http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/Whitelistorblacklistspecificincomingdata

Pierceyuk
Path Finder

Interesting so adding something like blacklist = %hostgoeshere. would filter out all this junk?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...