Splunk Routing to Non-Indexing Queue

[DanMelar]

Within Splunk, is there a way to route data to a queue that doesn't index. If so, could you turn on the ability to index that data if needed? I have a large amount of data coming in (100+GB Per Day) but have a very small license. Can this routing be done via the Splunk Server and not with a heavy forwarder?

[DanMelar]

I would not like to 'drop' the events, rather keep them and not index them.

[yannK]

Do not route to a non existing queue, it will simply block your indexer once full.

But you can route to the nullQueue to drop events.
http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Routeandfilterdatad#Discard_specific_events...

[DanMelar]

I would not like to 'drop' the events, rather keep them and not index them.

[bmacias84]

If I understand your question check out this post: http://splunk-base.splunk.com/answers/85943/prevent-log-events-with-specific-text-string-from-indexi...