Our generated logs need to be verified for correctness. After verification, they are sent to splunk.
Problem is the verification happens some hours after the logs are generated. This means they are sent to splunk hours after they are created (ie logs appear delayed, not in real time).
In 99.9999% of all cases, logs are verified ok which means this delay not needed.
Is there a way around this? My naive idea is to have splunk pick up the unverified logs immediately, and then (hours later) when they are verified confirm them in splunk or delete/mark/evict invalid logs from the index.
Is this possible or can I use some other approach?
/Thanks!
