Getting Data In

Remove events to avoid delayed logging?

wickman
Engager

Our generated logs need to be verified for correctness. After verification, they are sent to splunk.

Problem is the verification happens some hours after the logs are generated. This means they are sent to splunk hours after they are created (ie logs appear delayed, not in real time).

In 99.9999% of all cases, logs are verified ok which means this delay not needed.

Is there a way around this? My naive idea is to have splunk pick up the unverified logs immediately, and then (hours later) when they are verified confirm them in splunk or delete/mark/evict invalid logs from the index.

Is this possible or can I use some other approach?

/Thanks!

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If those cases really are rare you can use the delete command to selectively mark events as deleted. That won't clear up space, and isn't recommended for frequent use.

martin_mueller
SplunkTrust
SplunkTrust

Sure, you can start any search job remotely via the REST API or one of the SDKs available at http://dev.splunk.com/

0 Karma

wickman
Engager

Is it possible to script the delete command remotely? I'm thinking the verifier could do that automatically when it detects an invalid log?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...