What is the best approach to drop some of the data to nullQueue in Splunk Enterprise..?
You will need to route that data from your forwarder to your indexer via props.conf
and transforms.conf
So in your props.conf
you will create a stanza which will look like this
[WinEventLog:Security]
TRANSFORMS-t1=eliminate-eventcodes
Then in your transforms.conf
will need to look something like this
[eliminate-eventcodes]
REGEX=EventCode=Some_Regex_Here
DEST_KEY=queue
FORMAT=nullQueue
Here's a good article explaining how to do it
http://docs.splunk.com/Documentation/Splunk/6.0.5/Forwarding/Routeandfilterdatad
You can also key off the last digit of _time
. To drop 90%, keep only _time
values that end in 9
(or any other number), etc.
You will need to route that data from your forwarder to your indexer via props.conf
and transforms.conf
So in your props.conf
you will create a stanza which will look like this
[WinEventLog:Security]
TRANSFORMS-t1=eliminate-eventcodes
Then in your transforms.conf
will need to look something like this
[eliminate-eventcodes]
REGEX=EventCode=Some_Regex_Here
DEST_KEY=queue
FORMAT=nullQueue
Here's a good article explaining how to do it
http://docs.splunk.com/Documentation/Splunk/6.0.5/Forwarding/Routeandfilterdatad