splunk-ingest-actions-setup

Splunk Ingest Actions rulesets are rendered and bound to source types via props.conf and transforms.conf to apply data-filtering, masking, and routing at ingest time. Changes apply through REST endpoints with preflight validation.

Yes, you can configure Remote File System (RFS) S3 destinations in outputs.conf and render route-s3 rules per source type. The workflow operates console-free and binds assets through REST endpoints, requiring irreversible-ingest approval to apply.

Ingest Actions provide console-free, config-driven ingest-time data shaping for eval, mask, drop, and route-s3 rules. Unlike manual props.conf edits, this approach enforces render-first workflows, preflight checks, and strict validation before binding.

To apply a drop rule, render the ruleset for the noisy source type and review the generated assets. The workflow enforces preflight checks and irreversible-ingest approval before binding the rule through REST endpoints.

Yes, REST API access is required because the workflow binds rendered Ingest Actions rulesets and RFS S3 destinations to Splunk via REST endpoints. The process enforces render-first workflows and strict validation before applying.

Irreversible-ingest approval is required because Ingest Actions execute data-filtering, masking, dropping, and routing at ingest time. This safeguard enforces strict validation and preflight checks before binding rulesets to source types via REST endpoints.