Archive
Highlighted

Stop data flowing into 1 of my Indexes

Explorer

Is there a quick way to stop all data flowing into one of my indexes on a temp basis.

I have a windowsec index that is recieving 25GB per day, at this time I don't need the data, I would like to be able to quickly stop that data flowing in so that I can save this license cost but quickly restart the data flow again when the requirement exists in a few months.

Tags (3)
0 Karma
Highlighted

Re: Stop data flowing into 1 of my Indexes

Splunk Employee
Splunk Employee

There are instructions in the Forwarding Data manual that explain how to filter data by target index.

0 Karma