So I have a syslog fowarder with splunk light fowarder installed.
I have a /var/syslog/* monitor statement, and also some custom ones where needed /var/syslog/servername1/* index=test etc...
I have noticed that some users send in some real crappy data(example %hostgoeshere+timestamp) Without removing my catch all monitor statement and having a never ending task of adding new hosts.
Is there a way with the monitor statement to send this data to the null queue?
Something like
[monitor:///var/syslog/%hostgoeshere*/*.log]
index=null
Don't see the notes anyway without having to use transforms etc... but I think this must be easier.
Have you considered setting the blacklist attribute as per http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/inputsconf?
Have you considered setting the blacklist attribute as per http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/inputsconf?
Yup, a file will be ignored if its path matches the regex specified in a blacklist attribute. There's more info here: http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/Whitelistorblacklistspecificincomingdata
Interesting so adding something like blacklist = %hostgoeshere. would filter out all this junk?