Installation
Highlighted

Restrict data to be indexed

Explorer

Hi, Im looking to find a remedy to restict the data that is being indexed by splunk to just error messages. The reason being is the data being indexed by a particular host is exceeding what my license allows. I believe there are particular config files that can be modified to do this?

Thanks

0 Karma
Highlighted

Re: Restrict data to be indexed

Contributor

nrelihan,

What you are looking for is the nullQueue in Splunk. Essentially you use your parsing configs to determine what events should be deleted or preserved, depending on your situation.

You can find instructions in the docs, and there are many answers already posted that might address your specific needs.

Sean

View solution in original post

Highlighted

Re: Restrict data to be indexed

Explorer

Thats great Sean, exactly what I'm looking for, I'll have to do a bit of reading to wrap my head around it. thanks.

0 Karma