Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Is there an easy way to disable indexing for a source instead of filtering to nullQueue?

$
0
0
There are some situations in which we know that a certain source is going to be creating a lot of garbage data since we're running a test. So it would be ideal if we could disable indexing on this source so that we don't have to sort through all the garbage and so that the garbage isn't counted toward the license usage. I've looked into filtering to a nullQueue, and that's an option. However, it seems like somewhat of a hassle to modify two conf files any time I want to stop indexing. Has anyone run into a better way of doing this or a way to make it easier? Thanks!

Viewing all articles
Browse latest Browse all 47296

Trending Articles