so i had this problem and after so much wasting of my time trying to find the problem, it turned out that my management port 8089 was not enabled on the "Security Group" that i was using and the moment i added that port everything worked like magic. And i was able to go to sleep. Lol 😂 ... View more

@kasturea, Best practices would be to avoid writing events to files that you don't want to collect or separate into different files based on the type or usability and then forward only those files to Splunk which are interesting for you. If both of these options are not applicable for you, then the next solution would be filtering the events before they get into the Splunk indexes. The Splunk forwarder forwards all events, whatever it gets, without any filter. So we need to have an intermediate forwarder(heavy forwarder) to do the filtering before the event reaches the indexer or do the filtering at indexer side before it gets indexed. Depending on your Splunk deployment, you could do it on either side i.e. HF or indexer. Here is a documentation which explains how to use the filtering Discard specific events and keep the rest OR Keep specific events and discard the rest based on the amount of data you discard or accept. In your case, you have to do the filtering on time. i.e. send only data from 11am to 12pm. Refer to this example from @MuS which explains How to index certain logs only during a certain time range ... View more

Try this: your base search | timechart span=1min count by Source, IP ... View more