HI I setup trial splunk and app for citrix. The only thing i want to control overtime is how many concurrent users and sessions i have at a given time. I'm getting a lot of data (cpu , memory etc etc), and splunk is indexing much more than 500 MB / day for 3 xenapp servers. What i would like to know is how to setup the forwarder in order to just get / index the minimum data so i can control users and session usage ?
↧