@hmarkus .Thank you for your reply .Once I enable back do i get the old events that were already indexed and do I get the data during the index disabled time . If I want to ignore the data which is queued ,how can I do that and I do get the data whihc was indexed before the index is disabled right? Thanks in Advance ... View more

You could use Heavy Forwarder or build a App for Splunk Cloud to filter your Logs. If you know, how your unnecessary Logs look like, you can filter it: add in props.conf TRANSFORMS-asa_filter_cloud = filterAsaLogs add in transforms.conf [filterAsaLogs] SOURCE_KEY = _raw DEST_KEY = queue FORMAT = nullQueue REGEX = (your regex to detect them) ... View more

This, obviously, works, TA_LOG/default/inputs.conf [monitor:///tmp/*.TXT] index=main sourcetype=TMP:TXT crcSalt = <SOURCE> followSymlink = true TA_LOG2/default/inputs.conf [monitor:///tmp_ln/*.TXT] index=test sourcetype=TMP:TXT_BIS crcSalt = <SOURCE> followSymlink = true IMHO, crcSalt should work in same stanza, multiple inputs.conf and so... IMHO it does not work!!!!! ... View more