Step 3: Apply a Retention Policy

This stage deletes fixture records before they reach Splunk HEC. Source filtering and search filtering are different controls: a search hides indexed records from a result, while this mapping prevents deleted records from reaching the destination.

Reference mapping

pipeline:
  processors:
    - mapping: |
        if this.level == "DEBUG" {
          root = deleted()
        }
        if this.message.contains("Health check passed") {
          root = deleted()
        }

Review the policy

Record the event classes and bytes before and after filtering with representative traffic. Test required security, audit, investigation, and operational records explicitly. A sample that removes events successfully does not establish that the policy is safe.

Keep reject and observation paths separate from the main HEC output. Define what happens when parsing fails, a policy field is absent, or destination delivery is unavailable.

Boundary

This authored rule removes debug and health-check fixture lines. It makes no prediction about ingest, licensing, storage, or commercial outcomes for a Splunk environment.

Next: Route retained events to HEC.