we have many sources that sends us a lot of similar events (DNS for example)
Is there a way for me to aggregate the events to one single event and just add the count of events that happened (lets say in one minute) ? so I will only index:
a.host.com 18.104.22.168 count=3
Is it possible to do this in splunk ( maybe with regex in transforms)?
For now we are depended on 3rd party agents like arcsight in front of splunk to do the aggregation - I would really like to see this feature in splunk
A) Create a preprocessor program in any language that will aggregate the data and create a single event.
B) Add the events to a temporary index that rolls off in a few hours or days, then create a summary index using that temporary index as input.