Getting Data In

Can we filter events coming from a specific splunk_server?

teddyidc1101
Communicator

The search head we use searches events from test and prod indexer. In prod, we only need to capture the one from prod indexer. Can we filter events coming from specific a splunk_server? Or how do we point a search head to only get data from prod indexer?

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @teddyidc1101

Did the answer below solve your problem? If so, please resolve this post by approving it!
If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

renjith_nair
Legend

@teddyidc1101 ,

In a distributed environment, you can remove the search peer as mentioned in https://docs.splunk.com/Documentation/Splunk/7.1.3/DistSearch/Removeasearchpeer . This will remove the test indexer from searching permanently which is advisable for production environment. If you want a temporary solution, then include this in your searches splunk_server="prod indexer name"

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...