All Apps and Add-ons

Cisco Cloud Web Security (CWS) Add-on for Splunk: How to change the frequency logs are collected?

isabelops
Engager

After installing and configuring the CWS add-on, I'm able to see the logs in Splunk, but the collection interval seems to be every hour. Is there a way to change it so it occurs more frequently?

In the documentation it is stated,
"Sync should begin in a few minutes as the cron job runs in the background and ingests the CWS log data."
But I'm not able to find the cron job

0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

you should be able to copy default/inputs.conf to local/inputs.conf and change the interval value.

View solution in original post

jcoates_splunk
Splunk Employee
Splunk Employee

you should be able to copy default/inputs.conf to local/inputs.conf and change the interval value.

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!