Hi,
I have a use case where we want build trust between app server and Splunk indexer such that whenever there is post message from app server to the Indexer it should check the index = app name ; if it do not find the index then create one. We are using HEC events.
How is it possible ?
Also is there any performance issue on Indexer because of it?
↧