Getting Data In

How to customize nullqueue and indexqueue filtering with new patterns over time?

meenal901
Communicator

Hi,
I have a scenario like this: I want to filter data using NullQueue and IndexQueue. I also have the patterns with me. But there is a high possibility that the new patterns may be added to this list for filtering. Now if I put it in indexer (props.conf+transforms.conf), won't I have to re-index complete data everytime? Is there an alternate solution? How does this work in Heavy Forwarder?

Thanks,
Meenal

0 Karma
1 Solution

strive
Influencer

The old data that was indexed already cannot be changed. The new patterns will be applied to any new data that is coming in.

View solution in original post

0 Karma

strive
Influencer

The old data that was indexed already cannot be changed. The new patterns will be applied to any new data that is coming in.

0 Karma

meenal901
Communicator

Okay, thanks Strive.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...