# Get the license usage down in Splunk when indexing Bro logs **URL:** \ **Category:** Zeek\ **Created:** [July 12, 2017, 8:14pm UTC](https://community.zeek.org/t/get-the-license-usage-down-in-splunk-when-indexing-bro-logs/4942 "2017-07-12T20:14:38Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![fatema\_bannatwala](https://avatars.discourse-cdn.com/v4/letter/f/5f9b8f/32.png) [@fatema\_bannatwala](https://community.zeek.org/u/fatema_bannatwala)\ **Post date:** [July 12, 2017, 8:14pm UTC](https://community.zeek.org/t/get-the-license-usage-down-in-splunk-when-indexing-bro-logs/4942/1 "2017-07-12T20:14:38Z")
We only do filtering on conn logs, as they are the heaviest (in our environment at least), before indexing it in Splunk. Also, if you are ingesting files.log as well, then you can build some similar filters in props and transforms for the mime-type you can ignore (like plain/text etc), that will also reduce some of the volume indexed by your Splunk cluster. I do not know much about the cloud deployment, hence can’t comment on that. Regards, Fatema. ---
**Author:** ![SwedishMike](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/swedishmike/32/605_2.png) [@SwedishMike](https://community.zeek.org/u/SwedishMike)\ **Post date:** [July 12, 2017, 8:35pm UTC](https://community.zeek.org/t/get-the-license-usage-down-in-splunk-when-indexing-bro-logs/4942/2 "2017-07-12T20:35:56Z")
Fatema, Trying to filter out on types in the the files.log as well sounds like a great idea. We’re a bit more limited as to what we can do ourselves when it comes to cloud Splunk but I’m sure they’re more than happy to sell some PS time if need be. 😉 Once again - many thanks for a very helpful suggestion. Cheers, Mike ---
**Author:** ![fatema\_bannatwala](https://avatars.discourse-cdn.com/v4/letter/f/5f9b8f/32.png) [@fatema\_bannatwala](https://community.zeek.org/u/fatema_bannatwala)\ **Post date:** [July 12, 2017, 11:48pm UTC](https://community.zeek.org/t/get-the-license-usage-down-in-splunk-when-indexing-bro-logs/4942/3 "2017-07-12T23:48:44Z")
Hey Mike, So just out of curiosity, I ran a quick search on the files.log for the past hour, to see the top most logged mime-types, and here is the top 12 mime-types in the file: 2630139 application/pkix-cert 366285 text/plain 259828 - 258732 image/gif 175465 text/html 142375 image/jpeg 116151 application/xml 103263 text/json 70691 image/png 48208 application/ocsp-response 18720 application/ocsp-request 16267 application/javascript The Splunk filter can be easily built to ignore or filter the logs with these mime-types (of-course, only if you don’t want them in Splunk): In profs.conf: [bro\_files\_sourcetype] TRANSFORMS-null= bro\_files\_setnull In transforms.conf: [brol\_files\_setnull] REGEX = (application/pkix-cert|text/plain|image/gif|text/html|image/jpeg) DEST\_KEY = queue FORMAT = nullQueue You can add more mime-types in the above REGEX, to filter and send to null queue in Splunk. I added top five, just to give you an idea of how it can be implemented. Hope this helps. 🙂 Thanks, Fatema. ---
**Author:** ![SwedishMike](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/swedishmike/32/605_2.png) [@SwedishMike](https://community.zeek.org/u/SwedishMike)\ **Post date:** [July 13, 2017, 6:53am UTC](https://community.zeek.org/t/get-the-license-usage-down-in-splunk-when-indexing-bro-logs/4942/4 "2017-07-13T06:53:04Z")
Fatema, Many thanks yet again. Just for your comparison - here’s the top 12 from our current files.log, which is about 50 minutes old and about to rotate out. 1271142 application/pkix-cert 182904 text/plain 54187 text/json 49992 application/xml 46694 text/html 30609 - 19430 image/png 9421 image/jpeg 4778 image/gif 3664 application/x-dosexec 3049 text/ini 1304 application/vnd.ms-cab-compressed Getting rid of just the ‘application/pkix-cert’ would probably save us lots of license here so your tip is really good. Cheers, Mike ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/get-the-license-usage-down-in-splunk-when-indexing-bro-logs/4942/5 "2022-05-06T15:45:07Z")