syslog message filtering

[appmandan]

Is there a configuration file or something I can use to keep splunk from indexing a syslog message with a certain host ip or a certain message sting in the body? I'm playing with the cisco security suite and there are a few things I want to drop before they get indexed.

Thanks

[Drainy · Accepted solution]

There is something called a nullQueue in splunk, when an event arrives it goes through several stages of parsing and queues before eventually being indexed. Just before it arrives at the index you can filter off certain events into a "nullQueue". These do not get indexed and simply get written away.

Have a read of;
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad#Filter_event_data_and_...

If you have any problems then just update your question with anything you've tried and the community can help troubleshoot it further.