Question on dropping certain syslog events

[BrendanCO]

Hi guys. I've got both Palo Alto and Fortinet logs coming in to my Splunk instances and have the appropriate apps set up for each. The thing I'd like to do is see if there are any chatty and mostly useless events I can have Splunk drop and not process before it is received and counted against my license. Palos are pretty good about how to trim in the FW itself but the Fortinet isn't quite as granular.

Is there something I can put an inputs.conf file (or another similar app conf file) that will tell it to just drop an incoming event if it contains X?

[gcusello]

Hi @BrendanCO,

it isn't possible to filter data on inputs.conf, with the only exception of wineventlogs.

So, you have to analyze your logs and find a rule  (to transform in a regex) to exactly identify the logs to discard: e.g. if you found that the events in the sourcetype "your_sourcetype" containing the string "INFO" are to drop before indexing, you can create a rule in props.conf and transforms.conf like this:

props.conf

[your_sourcetype]
TRANSFORMS-drop_PA_events = drop_PA_events

 transforms.conf

[drop_PA_events]
REGEX = INFO
DEST_KEY = queue
FORMAT = nullQueue

Remember that these props.conf and transforms.conf must be on Indexers and (when present) on Heavy Forwarders.

You can find more infos at https://docs.splunk.com/Documentation/Splunk/8.1.0/Forwarding/Routeandfilterdatad#Filter_event_data_...

Ciao.

Giuseppe