Collection
Use the Collection page to manage all of your Collectors and Sources. To access the Collection page, go to Manage > Collection > Collection (Manage > Collection in the classic UI).
At the top of the page, you can:
- Search for a Collector or Source
- Open the Setup Wizard to configure Collectors and Sources automatically
- Upgrade Collectors
- Add an Installed Collector or a Hosted Collector
- Manage Access Keys
- Use the Show options to filter the list
- Use the Expand options to show or hide information about the Sources
- Use the paging controls to navigate the list of Collectors
The page displays the following information about Collectors and Sources:
- Name. Displays the name of the Collector, and any Sources that are configured under it. It also displays the type of Source (HTTP, Local File, Local Windows Event Log, etc.)
- Open in Search. Hover over the Name of the Collector or Source and click the Open in Search icon to start a search in the Search page.
- Tool Tip. Hover over the Source name to display an informational tool tip.
- Type. Displays whether the Collector is an Installed or Hosted Collector.
- Status. Displays whether the Collector is Running (green checkmark) or Stopped (red exclamation point).
- Source Category. Displays the name of the configured Source Category for this Collector or Source.
- Sources. Displays the number of Sources configured under a Collector.
- Last Hour. Displays a graph of the total number of log messages ingested per minute over the past hour.
- Messages. Displays the total number of log messages ingested over the past hour.
From here you can perform these Collector actions:
- Add a Source
- Edit a Collector
- Delete a Collector
- Download a JSON configuration file for scripting or backup
From here you can perform these Source actions:
- Edit the Source
- Delete a Source
- Download a JSON configuration file for scripting or backup
- Pause or resume a Source (cloud polling Sources only)
- Show or regenerate a Source URL (HTTP Sources only)
- Show or regenerate a Source token (cloud syslog Source only)