Site CollectorSite Collector Administration Guide

On the New-Scale Security Operations Platform home page, click the Collectors tile.

Select Site Collectors from the sub-menu.

The Overview section displays status groups, last day average volume, and a list of Site Collectors.

On the Overview tab, click the Splunk Collector instance for which you want to modify the configuration.

Modify the Splunk query and select the desired Splunk fetch interval, then click Update. If you update the query, Site Collector Core fetches log data with the parameters based on the query.

Update the Splunk Fetch Timestamp by selecting the time and date from when you want the collector to fetch logs. You can select a date previous to the present date, which is backdated to 30 days.

Click Definition to edit Splunk Collector name, select a Site Collector instance, Splunk hostname, and port.

Click Authentication to change the authentication method: Login Pass or Token for the Splunk collector to connect to the sever. Based on the authentication method that you select, you can edit the login name and password, or the token number for the Splunk server. In this section, you can also edit the protocol and tls option to securely pull the data.

To stop or delete the Splunk Collector instance in Running state, in the upper right corner, click Stop or Delete.