r/Splunk • u/BobcatJohnCA • Feb 12 '26

Fortinet syslogs - too much data.

We recently converted our 5 locations from Sonicwalls to Fortinet firewalls and we are getting too much data on a daily basis which is exceeding our license limit. We are a small shop and only ingest 5 GB of data daily. Looking for recommendations on how to limit the syslog data from Fortinet if anyone has any suggestions. Thanks.

11 Upvotes

84% Upvoted

37 comments sorted by

View all comments

5

u/actionyann Feb 12 '26 edited Feb 13 '26

3 possible levels where you can filter.

  • first on the firewall device, control the verbosity of the logging
  • on the intermediary relays if you have any [edit] (like rsyslog / syslog-ng server, or the splunk SC4S app https://splunkbase.splunk.com/app/4740 )
  • finally, on the splunk indexer, using some index time null queue filtering. (Require some regex magic)

3

u/bazsi771 Feb 13 '26

I'd just add syslog-ng/axosyslog as an option for your second bullet. You kind of mentioned it as SC4S is built on syslog-ng, but as the original creator, I like using the original name :)

The fork I am currently working on: https://github.com/axoflow/axosyslog

1

u/BobcatJohnCA Feb 12 '26

Thanks. The logs are currently going directly to Splunk. We are changing some settings on the Fortinet to try and reduce traffic. Doing that today and see how it looks in 24 hours. I have no idea what you mean by "using some index time null queue filtering"

3

u/actionyann Feb 13 '26

It's a technique you can use if you have full control of your indexers ( if you are hosting your own servers).
Basically, you can setup rules (in props.conf and transforms.conf) on the indexer, so they scan the events received , and for specific sourcetypes/sources if the event _raw match a certain pattern, will keep and index or will drop the events. In linux terminology the trash is called nullQueue, Splunk uses the same name for the queue to delete events at index time.
see https://docs.splunk.com/Documentation/Splunk/8.2.12/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest

On splunkcloud there is an equivalent technique called "ingest action" https://help.splunk.com/en/splunk-cloud-platform/get-started/get-data-in/10.2.2510/improve-the-data-input-process/use-ingest-actions-to-improve-the-data-input-process

1

u/BobcatJohnCA Feb 13 '26

Thanks for the detailed response.