Currently my Heavy Forwarder is receiving unwanted logs from a lot of different devices, and it is taking up a lot of space. Is there a way to prevent / reject logs from all servers, and manually add server logs that we want to monitor into whitelist, so that it doesn't take up free space in my Heavy Forwarder.   So basically, reject all logs from all server. Accept logs only from server1 and server2.    Thank you in advance. ... View more

Hi all, I would like to ask this.   So for example I assigned app1 and app2 into a server class. How can I find out the index that app1 and app2 use.   I know the alternative way is to look through the file system > etc > Deployment App > local  > index=test But is there a way to find out the index, without going into the machine file system or CLI.   Thank you for any help provided. ... View more

I would like to run a search query every few min, how can i do that. E.g. index = "a" sourcetype = "b" Any help is appreciated. ... View more