Some events are simply not worth indexing. The hard part is figuring out which ones these are and making very sure you're not wrong. Dropping too many events can make you blind to real problems at critical times, and can introduce more problems than tuning Splunk to deal with the greater volume of data in the first place.
With that warning stated, if you know what events you do not need, the procedure for dropping events is pretty simple. Say we have an event such as this one:
2012-02-02 12:24:23 UTC TRACE Database call 1 of 1,000. [...]
I know absolutely that, in this case and for this particular source type, I do not want to index TRACE-level events.
In props.conf, I will create a stanza for my source type, as shown here: ...
