Archive

how to timing deliver forwarder index data to index server

Explorer

Now I want to deliver forwarder index data to index server due to network bandwidth? first , forwarder receiver data from windows all the time; second, at 0:00-3:00 forwarder deliver data to splunk index server. How to do it? Thanks in advance!

Tags (3)
0 Karma

Legend

You can't put a schedule for when forwarding occurs, other than keeping the forwarder turned off and just turn it on when you need it.

Have a look at these other questions that cover pretty much the same thing:
http://splunk-base.splunk.com/answers/59916/can-you-set-a-certain-time-forwarding-occurs
http://splunk-base.splunk.com/answers/58980/how-to-schedule-a-transfer-on-a-forwarder

0 Karma