Getting Data In

What is the best approach to drop some of the data to nullQueue in Splunk Enterprise..?

prakash007
Builder

What is the best approach to drop some of the data to nullQueue in Splunk Enterprise..?

Tags (1)
1 Solution

skoelpin
SplunkTrust
SplunkTrust

You will need to route that data from your forwarder to your indexer via props.conf and transforms.conf

So in your props.conf you will create a stanza which will look like this

[WinEventLog:Security]
 TRANSFORMS-t1=eliminate-eventcodes

Then in your transforms.conf will need to look something like this

[eliminate-eventcodes]
     REGEX=EventCode=Some_Regex_Here
     DEST_KEY=queue
     FORMAT=nullQueue

Here's a good article explaining how to do it

http://docs.splunk.com/Documentation/Splunk/6.0.5/Forwarding/Routeandfilterdatad

View solution in original post

woodcock
Esteemed Legend

You can also key off the last digit of _time. To drop 90%, keep only _time values that end in 9 (or any other number), etc.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You will need to route that data from your forwarder to your indexer via props.conf and transforms.conf

So in your props.conf you will create a stanza which will look like this

[WinEventLog:Security]
 TRANSFORMS-t1=eliminate-eventcodes

Then in your transforms.conf will need to look something like this

[eliminate-eventcodes]
     REGEX=EventCode=Some_Regex_Here
     DEST_KEY=queue
     FORMAT=nullQueue

Here's a good article explaining how to do it

http://docs.splunk.com/Documentation/Splunk/6.0.5/Forwarding/Routeandfilterdatad

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...