About Sree

Sree · ‎07-22-2021

Hi, I'm trying to configure HEC in our indexer cluster which doesn't have any HFs. Could anyone tell me about the process? I also read some community answers and documents that we create the tokens in CM and distribute to indexers.But i'm quite new to such process. Any detail steps are very much appreciated.

Sree · ‎07-22-2021

Hi @richgalloway Thanks for the reply but your answer is for the splunk events that got already indexed. I'm trying to filter the data at the sourcetype level before it gets indexed.

Sree · ‎07-20-2021

Hi, I'm trying to exclude events that have an old timestamp in a url which look like this - {"timestamp": 1626739199.964, "c-ip": "178.245.92.14", "time-to-first-byte": 0.002, "sc-status": 404, "sc-bytes": 467, "cs-method": "GET", "cs-protocol": "https", "cs-host": "xxxxxxx", "cs-uri-stem": "/out/v1/bac5ea7d5e06476598d34ba48b3f1bd1/index_8_0.m3u8?start=2021-07-16T16:40:07+00:00", here timestamp and the start date are different.So is there any way to index the events have start date as current day. Thanks in advance

Posts	3
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎07-20-2021

Online Status	Offline
Date Last Visited	‎09-28-2021 05:13 AM

Create HEC in indexer cluster

Exclude Old data

Create HEC in indexer cluster

Re: Exclude Old data

Exclude Old data

Are you a member of the Splunk Community?

Create HEC in indexer cluster

Exclude Old data

Create HEC in indexer cluster

Re: Exclude Old data

Exclude Old data