What is the best approach to drop some of the data to nullQueue in Splunk Enterprise..?

[prakash007]

What is the best approach to drop some of the data to nullQueue in Splunk Enterprise..?

[woodcock]

You can also key off the last digit of _time. To drop 90%, keep only _time values that end in 9 (or any other number), etc.

[skoelpin · Accepted solution]

You will need to route that data from your forwarder to your indexer via props.conf and transforms.conf

So in your props.conf you will create a stanza which will look like this

[WinEventLog:Security]
 TRANSFORMS-t1=eliminate-eventcodes

Then in your transforms.conf will need to look something like this

[eliminate-eventcodes]
     REGEX=EventCode=Some_Regex_Here
     DEST_KEY=queue
     FORMAT=nullQueue

Here's a good article explaining how to do it

http://docs.splunk.com/Documentation/Splunk/6.0.5/Forwarding/Routeandfilterdatad