Restrict data to be indexed

[nrelihan]

Hi, Im looking to find a remedy to restict the data that is being indexed by splunk to just error messages. The reason being is the data being indexed by a particular host is exceeding what my license allows. I believe there are particular config files that can be modified to do this?

Thanks

[sdwilkerson · Accepted solution]

nrelihan,

What you are looking for is the nullQueue in Splunk. Essentially you use your parsing configs to determine what events should be deleted or preserved, depending on your situation.

You can find instructions in the docs, and there are many answers already posted that might address your specific needs.

Sean

[nrelihan]

Thats great Sean, exactly what I'm looking for, I'll have to do a bit of reading to wrap my head around it. thanks.