What are ways to optimize splunk license usage?

[aswinkumar6]

I'm using splunk enterprise. I need inforation on what are the ways and methods we can use to optimize splunk license.
For ex: in my log files I'm receiving Healthcheck messages frequently and I don't want to log these messages in my indexes. Inorder to stop incoming data with Healthcheck in message and response code as 200 I'm blacklisting the messages in splukds.
Similarly, What are the other methods to optimize splunk logs and use max utilization of splunk license?

[gcusello]

Hi @aswinkumar6,
there only one way: filter useless events before indexing.

There are only two methods to do this:

• only on windows it's possible to filter events on Universal Forwarders using whitelists and/or blacklists of EventCodes;
• for all the other logs, it's possible to filter events before indexing following the instructions at https://docs.splunk.com/Documentation/Splunk/8.0.3/Forwarding/Routeandfilterdatad#Filter_event_data_... .

The first method is preferable because you filter at the origin and you don use network bandwidth.
The second permites to take specified events and discard the others or discard specified events and take the others; you need only to find the regex to filter them.

Ciao.
Giuseppe