Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Half event to index queue and half event to null queue

$
0
0
Hi All, Is there a possibility to send half of the event to index queue and half of the event to null queue?? Can this be done based on the size of the event, for example only 1Kb event should be indexed out of 1MB event and rest should be sent to null queue. Thanks in advance for your inputs! Regards, BK

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>