Creating a new Store and Forward schedule

Use the Store and Forward Schedule wizard to create a schedule that controls when your event collector starts and stops forwarding data to an event processor.

You can create and manage multiple schedules to control event forwarding from multiple IBM QRadar event collectors in a geographically distributed deployment.

Before you begin

Ensure that your dedicated event collector is added to your deployment and connected to an event processor. Use the System and License Management window to configure the connection between an event collector and an event processor.

Procedure

  1. On the navigation menu ( Navigation menu icon ), click Admin.
  2. In the System Configuration section, click Store and Forward.
  3. Click Actions > Create.
    1. Click Next to move to the Select Collectors page.
    2. On the Select Collectors page, configure the parameters.

      If the event collector that you want to configure is not listed, you must add it before you can proceed. For more information about adding an event collector, see Adding a managed host.

    3. On the Schedule Options page, configure the parameters.
      Note: The minimum transfer rate is 0. The maximum transfer rate is 9,999,999. A value of 0 means that the transfer rate is unlimited.
    4. Finish the configuration.

      You can now view the schedule in the Store and Forward window. After you create a new schedule, it might take up to 10 minutes for statistics to start displaying in the Store and Forward window.