I am setting up distributed deployment monitor and trying to follow the Best Practices of sending the search head internal data to the indexers but using the basic recommended outputs.conf it also forwards the files in the dispatch folder to the indexer. I have very limited space for this folder on the indexer. How do you not forward the dispatch folder?
Thanks
↧
Best Practice forward search head to indexer but dispatch folder fills -how to not forward dispatch
↧