How do I filter incoming data to prevent license violations?

[cparker4486]

Hello,

I'm attempting to use the free edition but with only collecting data from the local machine I'm filling up my 500MB quota in just a few hours.

I don't know if Splunk works this way but I thought I could cut back on incoming data by filtering out informational log events. That is I would like to accept only warnings and errors.

Is this possible?

[hokie1999]

Can I blacklist from the indexers and save myself some typing? Send a link to the doc that explains this, thanks.

[Ayn]

It certainly is. You do this by matching events that should be sent to the "nullQueue" instead of the "indexQueue". The docs have good descriptions with examples on how to achieve this: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad#Discard_specific_event...

[jbsplunk]

nullQueue routing is the only way to prevent the indexing of certain types of data. You can set up transforms for different sources/hosts/sourcetypes, so there is a good amount of flexibility on how you'd want to call the transform to perform this action. So it isn't like you've really got limitations in terms of having to create a single list.

[cparker4486]

Thanks for the information. After doing some research this system is turning out to be quite a bit more complicated than I expected. The biggest problem I see is that there are so many different types of events with different formats that I can not reasonably maintain an include/exclude list. Do you have any further advice on this?