/
Changing the Destination Mode
Document toolboxDocument toolbox

Changing the Destination Mode

Owned by Shirly Tsang
Aug 13, 2021

By default, the destination mode is set to Disabled for all destinations. You can change the default destination mode to one of the following:

  • Forward: When the destination mode is set to Forward, the data files are generated for the output and forwarded to the remote host. The data files are deleted after successful transfer of the data files to the destination. If transfer of any data file fails, then such file is deleted when the disk space of the Data Connector is low and when the file is older than the retention period.
  • Hold: Data files are generated for the specific destination, but the data files are not forwarded to the remote host. The data files are deleted as soon as they get older than the retention period.
  • Disabled: Generation of data files will be disabled for the destination.

    To change the default mode of a destination, you can log in to the Data Connector CLI and run the following command:
    For Infoblox cloud destination:
    data.destination.cloud > set mode [forward|hold|disabled]
    For Infoblox reporting destination:
    data.destination.reporting > set mode [forward|hold|disabled]
    For Splunk destination:
    data.destination.splunk > set mode [forward|hold|disabled]

  For IBM QRadar destination:
 data.destination.siem.QRadar > set mode [forward|hold|disabled] 

  For McAfee ESM destination:
 data.destination.siem.McAfee > set mode [forward|hold|disabled]

  For Micro Focus ArcSight ESM destination:
 data.destination.siem.ArcSight > set mode [forward|hold|disabled]

To view the destination mode, you can run the following command:

For Infoblox cloud destination:
data.destination.cloud > show mode
The output mode is forward

For Infoblox reporting destination:

data.destination.reporting > show mode
The output mode is hold

For Splunk destination:

data.destination.splunk > show mode
The output mode is hold 

For IBM QRadar destination:

data.destination.siem.QRadar > show mode
The output mode is hold

For McAfee ESM destination:

data.destination.siem.McAfee> show mode
The output mode is disabled

For Micro Focus ArcSight ESM destination:

data.destination.siem.ArcSight > show mode
The output mode is hold

Related content