Use Ingest Actions to shrink your ingest and make the most of your license!

On the 18th of September 2024 I gave a talk on this topic at the London Splunk User Group meetup.

Ingest Actions are a simple feature of Splunk core that allow you to quickly add index-time masking or routing configuration. It's nothing new compared to SEDCMD or props & transforms, but it's much more user-friendly and it offers a preview mode where you can see the impact of your ingest action BEFORE you impact anything.

 Here is the recording:

URL: https://splunk.zoom.us/rec/share/TySAYG9OBJh74V-dsnLqGZI6SRf0F_ig6X9yCQ0JVg7Tf_GwopVO2494agCAKWtE.tjjVVMrUPXN7hhe0

 Passcode: =iJ447JC 

 (Note: the = is part of the passcode!)

You can download the slides here:

2024-09 Splunk London User Group - Ingest Actions.pdf

Download PDF • 2.15MB