Getting Data In

Question on dropping certain syslog events

Path Finder

Hi guys. I've got both Palo Alto and Fortinet logs coming in to my Splunk instances and have the appropriate apps set up for each. The thing I'd like to do is see if there are any chatty and mostly useless events I can have Splunk drop and not process before it is received and counted against my license. Palos are pretty good about how to trim in the FW itself but the Fortinet isn't quite as granular.

Is there something I can put an inputs.conf file (or another similar app conf file) that will tell it to just drop an incoming event if it contains X?

Labels (1)
Tags (1)
0 Karma


Hi @BrendanCO,

it isn't possible to filter data on inputs.conf, with the only exception of wineventlogs.

So, you have to analyze your logs and find a rule  (to transform in a regex) to exactly identify the logs to discard: e.g. if you found that the events in the sourcetype "your_sourcetype" containing the string "INFO" are to drop before indexing, you can create a rule in props.conf and transforms.conf like this:



TRANSFORMS-drop_PA_events = drop_PA_events




DEST_KEY = queue
FORMAT = nullQueue


Remember that these props.conf and transforms.conf must be on Indexers and (when present) on Heavy Forwarders.

You can find more infos at



Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...