<p>I was trying to reduce the production of logs in splunk. when i tried to reduce the logs by using below query i was getting a large number of log entries</p>
<pre><code>Spunk query: (source!=&quot;/var/log/kubernetes/audit/kube-apiserver-audit.log&quot; cluster_name::dkp-test index=&quot;tst-dkp&quot;) null sourcetype=&quot;fluentd:monitor-agent&quot;
</code></pre>
<p>I was tried to reduce the log production by using <code>emit_interval 300</code> and <code>cache_ttl 3600</code> but it is not worked.</p>
<p>Can anyone please suggest how should i reduce the production of logs in splunk connector. Thanks.</p>
<p>I found that the logs were producing from the node:</p>
<pre><code>[ec2-user@ip-11-21-111-11 ~]$ sudo su
[root@ip-11-21-111-11 ec2-user]# ps -ef | grep flu
root     2536779 2536761  0 Jan31 ?        00:00:16 /usr/bin/fluentd -c /fluentd/etc/fluent.conf
root     2536965 2536779  0 Jan31 ?        00:07:34 /usr/bin/ruby -r/usr/local/share/gems/gems/bundler-2.2.33/lib/bundler/setup -Eascii-8bit:ascii-8bit /usr/bin/fluentd -c /fluentd/etc/fluent.conf --under-supervisor
root     2536978 2536965  0 Jan31 ?        00:00:00 sh -c jq  --unbuffered -c '.record.source = &quot;namespace:platform/pod:splunk-connect-splunk-kubernetes-logging-vmkjx&quot; | .record.sourcetype = &quot;fluentd:monitor-agent&quot; | .record.cluster_name = &quot;platform-dkp-test&quot; | .record.splunk_index = &quot;ss-tst-dkp&quot; | .record' 2&gt;&amp;1
root     2536980 2536978  0 Jan31 ?        00:00:02 jq --unbuffered -c .record.source = &quot;namespace:platform/pod:splunk-connect-splunk-kubernetes-logging-vmkjx&quot; | .record.sourcetype = &quot;fluentd:monitor-agent&quot; | .record.cluster_name = &quot;platform-dkp-test&quot; | .record.splunk_index = &quot;ss-tst-dkp&quot; | .record
root     3730152 3730072  0 13:21 pts/0    00:00:00 grep --color=auto flu
</code></pre>
<p>The logs are generating from the splunk are :</p>
<pre><code>{ [-]
   emit_records: 0
   emit_size: 0
   output_plugin: false
   plugin_category: filter
   plugin_id: object:c11c
   retry_count: null
   type: jq_transformer
}
Show as raw text
host = ip-11-21-111-11.ec2.internalsource = namespace:platform/pod:splunk-connect-splunk-kubernetes-logging-jxsourcetype = fluentd:monitor-agent
</code></pre>
<p>in this i wanted reduce the logs for <code>Reduce logging for retry_count: null</code></p>

Sayon
<p>The only way to &quot;reduce the production of logs&quot; going into Splunk is to not log as much that the Universal Forwarder picks up, or that is sent via the HTTP Event Collector</p>
<p>If you want to <em>filter</em> events based on criteria in your SPL, then you need to look at the field(s) in question, and only select what you're looking for</p>
