Is there a method to ignore/exclude logging in splunkd.log for a particular event (similar to the nullQueue redirect for normal events in props/transforms.conf)?
A 3rd-party tool sends its syslog information to our Splunk environment via SSL; however, the indexer's splunkd.log records an X509 certificate error for every event. The vendor does not provide support to resolve the SSL error and, currently, we've not been able to resolve it in-house.
I know splunkd.log is part of the _internal index and does NOT count toward our licensing limit, but it is so spammy (dozens of entries every second) that I'd like to exclude it.
Note: I cannot disable the SSLCommon or X509Verify logging channels for security compliance purposes, so that's not an option.
↧