Installation

Restrict data to be indexed

nrelihan
Explorer

Hi, Im looking to find a remedy to restict the data that is being indexed by splunk to just error messages. The reason being is the data being indexed by a particular host is exceeding what my license allows. I believe there are particular config files that can be modified to do this?

Thanks

0 Karma
1 Solution

sdwilkerson
Contributor

nrelihan,

What you are looking for is the nullQueue in Splunk. Essentially you use your parsing configs to determine what events should be deleted or preserved, depending on your situation.

You can find instructions in the docs, and there are many answers already posted that might address your specific needs.

Sean

View solution in original post

sdwilkerson
Contributor

nrelihan,

What you are looking for is the nullQueue in Splunk. Essentially you use your parsing configs to determine what events should be deleted or preserved, depending on your situation.

You can find instructions in the docs, and there are many answers already posted that might address your specific needs.

Sean

nrelihan
Explorer

Thats great Sean, exactly what I'm looking for, I'll have to do a bit of reading to wrap my head around it. thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...