Within Splunk, is there a way to route data to a queue that doesn't index. If so, could you turn on the ability to index that data if needed? I have a large amount of data coming in (100+GB Per Day) but have a very small license. Can this routing be done via the Splunk Server and not with a heavy forwarder?
I would not like to 'drop' the events, rather keep them and not index them.
Do not route to a non existing queue, it will simply block your indexer once full.
But you can route to the nullQueue to drop events.
http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Routeandfilterdatad#Discard_specific_events...
I would not like to 'drop' the events, rather keep them and not index them.
If I understand your question check out this post: http://splunk-base.splunk.com/answers/85943/prevent-log-events-with-specific-text-string-from-indexi...