Splunk Enterprise Security

Splunk - Enterprise Security - Disable Splunk Web Messages


How can I selectively disable/suppress Splunk web messages? This one is quite a nuisance and quite obviously a bug of some kind:

Splunk_SA_CIM version 4.11.0 is lower than required 4.9.1
6/19/2018, 12:46:13 PM

It's starting to get a bit annoying clearing it over and over. 4.11.0 is obviously a higher version than 4.9.1 but I presume whatever is driving this message is only reading to 4.1* and interpreting that as a lower version.

Any help here would be hugely helpful!


If you are looking to get rid of those messages altogether, you could use props / transforms to get rid of those events at index time...


TRANSFORMS-get_rid_of_annoying_messages = shred_useless_cim_events


DEST_KEY = queue
FORMAT = nullQueue
REGEX = Splunk_SA_CIM\sversion\s4\.11\.0\sis\slower\sthan\srequired\s4\.9\.1

... These would need to be put on your indexers and / or heavy forwarders, depending on how data is coming into Splunk.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>