Hi @abdulhasnath ,
If you want to limit your data, you can configure props.conf and transforms.conf. You can discard unwanted data by routing it to nullQueue.
NOTE- When you filter out data in this way, the filtered data is not forwarded or added to the index at all, and doesn't count toward your indexing volume.
For detail information, you can follow the documentation here https://docs.splunk.com/Documentation/Splunk/6.0.3/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues
Hope it helps!!
Thanks
... View more