Getting Data In

What is the best approach to drop some of the data to nullQueue in Splunk Enterprise..?

prakash007
Builder

What is the best approach to drop some of the data to nullQueue in Splunk Enterprise..?

Tags (1)
1 Solution

skoelpin
SplunkTrust
SplunkTrust

You will need to route that data from your forwarder to your indexer via props.conf and transforms.conf

So in your props.conf you will create a stanza which will look like this

[WinEventLog:Security]
 TRANSFORMS-t1=eliminate-eventcodes

Then in your transforms.conf will need to look something like this

[eliminate-eventcodes]
     REGEX=EventCode=Some_Regex_Here
     DEST_KEY=queue
     FORMAT=nullQueue

Here's a good article explaining how to do it

http://docs.splunk.com/Documentation/Splunk/6.0.5/Forwarding/Routeandfilterdatad

View solution in original post

woodcock
Esteemed Legend

You can also key off the last digit of _time. To drop 90%, keep only _time values that end in 9 (or any other number), etc.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You will need to route that data from your forwarder to your indexer via props.conf and transforms.conf

So in your props.conf you will create a stanza which will look like this

[WinEventLog:Security]
 TRANSFORMS-t1=eliminate-eventcodes

Then in your transforms.conf will need to look something like this

[eliminate-eventcodes]
     REGEX=EventCode=Some_Regex_Here
     DEST_KEY=queue
     FORMAT=nullQueue

Here's a good article explaining how to do it

http://docs.splunk.com/Documentation/Splunk/6.0.5/Forwarding/Routeandfilterdatad

Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...