When data is coming into Splunk through the HTTP Event Collector, can some of it be routed to the nullqueue based on sourcetype to avoid indexing?
Hi @simpkins1958 ,
Yes it's possible. HEC is another input type and transformations can be applied to that as well. here is an example
props.conf
[nullq]
TRANSFORMS-set= setnull
transforms.conf
[setnull]
REGEX=.
DEST_KEY = queue
FORMAT = nullQueue
and my HEC conf from inputs.conf
[http://Test]
disabled = 0
index = main
token = myrandomtoken
sourcetype = nullq
Hi @simpkins1958 ,
Yes it's possible. HEC is another input type and transformations can be applied to that as well. here is an example
props.conf
[nullq]
TRANSFORMS-set= setnull
transforms.conf
[setnull]
REGEX=.
DEST_KEY = queue
FORMAT = nullQueue
and my HEC conf from inputs.conf
[http://Test]
disabled = 0
index = main
token = myrandomtoken
sourcetype = nullq
I haven't done anything with http event collector myself, but I would think you could do that. I could be wrong, but it's worth trying anyway, right? I think the event collector has to be installed on a Splunk Enterprise instance, so that's probably where you would need to configure the props/transforms to do the routing.
If you need help trying to set that up, feel free to give us some more details like the sourcetype and sample events you'd like to discard.