Splunk Dev

How do I filter out certain messages in Splunk Cloud?


I have a data source that is very noisy, and I'd like to exclude certain messages from that source from indexing in my Splunk Cloud instance.

I see from this answer that it's possible to filter out certain messages by editing config files in a self-hosted Splunk instances. How do I accomplish the same thing in Splunk Cloud? I'm guessing that it involves adding a field transformation from the GUI, but I don't understand how to complete the form when I just want to throw away messages that match my regex.

(I don't have enough points to post a link, sorry about that)

Tags (1)
0 Karma


Basically you come up with props.conf and transforms.conf settings that get applied at index time (whether that's with the UI or by hand, either way). (if it's message that matches a Regex, you would typically have a TRANSFORMS attribute in props, pointing to a stanza in transforms.conf that when your regex matches, it sets the next Queue to the nullQueue. See the example at: http://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Routeandfilterdatad#Filter_event_data_a...

With Splunk Cloud, I'm not sure if you could log a ticket once you've developed the configuration and get them to plop your settings onto your indexers (I would think this falls into "Modifying the configuration settings of your Splunk Cloud deployment" that Splunk Support is supposed to be able to help you with per the FAQ but I'm not a Splunk Cloud customer). The alternative is where you setup a (group of) Heavy Weight (Intermediate) Forwarder(s) ... in this setup instead of having your existing forwarders send directly to Splunk Cloud, they send to the HWFs. The HWFs apply all the parsing and filtering rules, and only forwards on those that you want to. This gives you more instant control of course, with the cost of maintaining more systems and settings obviously.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...