How to exclude certain OPSEC LEA events from getting indexed?

[echojacques]

Hi everyone,

I have the OPSECLEA TA installed and I'd like to strip out certain events (all destination port 80 (HTTP) events) from getting indexed; however, I'm not sure how to do this. The reason is that we have a heavy volume of allowed HTTP traffic that doesn't need to be indexed and it's saturating our license. I was able to strip out certain Windows WMI events from getting indexed using these instructions:

http://answers.splunk.com/answers/24000/how-do-i-exclude-some-windows-events-from-being-indexed

... but I haven't found a similar set of instructions for OPSECLEA.

Does anyone have any guidance for this? I'm very new to Splunk (enterprise license) and I'm not sure which transforms.conf or props.conf file to modify in order to do this.

Thanks

[jcoates_splunk · Accepted solution]

Hi, this might be a better source: http://answers.splunk.com/answers/76456/discarding-specific-event-and-keeping-the-rest

In props you want to call out a transforms stanza.

In that transforms stanza you want to define a regex and send matches to nullqueue.