bar logs with debug level enabled

[bmcaetano]

Is there any way to block logs coming from other servers, on a distributed server, with the debug level activated? I say this because our splunk is suffering performance degradation due to the amount of DEBUG logs. I'm still studying the props.conf documentation, would this be the right way to do this?

[bowesmana]

Take a look at Ingest Actions

bowesmana_0-1707099276364.png

[isoutamo]

Hi

another option is use those props.conf and transforms.conf files as you already have looked. Here is one old post to do it https://community.splunk.com/t5/Monitoring-Splunk/FortiGate-Firewall-is-consuming-the-license/m-p/64... There are lot of other examples in community and also on docs.splunk.com. 

One thing what you must remember is that you must put those configurations on 1st full splunk instance from source to indexers. This could be a HF or an indexer.

r. Ismo