Collection

Use the Collection page to manage all of your Collectors and Sources. To access the Collection page, go to Manage Data > Collection > Collection (Manage > Collection in the classic UI).

At the top of the page, you can:

• Search for a Collector or Source
• Open the Setup Wizard to configure Collectors and Sources automatically
• Upgrade Collectors
• Add an Installed Collector or a Hosted Collector
• Manage Access Keys
• Use the Show options to filter the list
• Use the Expand options to show or hide information about the Sources
• Use the paging controls to navigate the list of Collectors

The page displays the following information about Collectors and Sources:

• Name. Displays the name of the Collector, and any Sources that are configured under it. It also displays the type of Source (HTTP, Local File, Local Windows Event Log, etc.)
  • Open in Search. Hover over the Name of the Collector or Source and click the Open in Search icon to start a search in the Search page.
  • Tool Tip. Hover over the Source name to display an informational tool tip.
• Type. Displays whether the Collector is an Installed or Hosted Collector.
• Status. Displays whether the Collector is Running (green checkmark) or Stopped (red exclamation point).
• Source Category. Displays the name of the configured Source Category for this Collector or Source.
• Sources. Displays the number of Sources configured under a Collector.
• Last Hour. Displays a graph of the total number of log messages ingested per minute over the past hour.
• Messages. Displays the total number of log messages ingested over the past hour.

From here you can perform these Collector actions:

• Add a Source
• Edit a Collector
• Delete a Collector
• Download a JSON configuration file for scripting or backup

From here you can perform these Source actions:

• Edit the Source
• Delete a Source
• Download a JSON configuration file for scripting or backup
• Pause or resume a Source (cloud polling Sources only)
• Show or regenerate a Source URL (HTTP Sources only)
• Show or regenerate a Source token (cloud syslog Source only)