topic Re: Splunk Add-on for Microsoft Windows: How do I specify which index to send data to? in All Apps and Add-ons

Splunk Add-on for Microsoft Windows: How do I specify which index to send data to?

andrewtrobec — Thu, 19 May 2022 18:00:31 GMT

Hello,

I've just installed the Splunk Add-on for Microsoft Windows and I will be collecting data from UFs that forward first to a HF and then to an indexing cluster. The app will be deployed to multiple UFs via deployment server. I only want to collect data from the machines that the UFs are installed on.

I see that there is no way to specify within inputs.conf which index to send the data to. I've read the documentation but I still don't understand how. I've even found this post which discusses the same topic but doesn't really provide me with an answer that I understand (sends me to documentation for older version of the add-on).

Could somebody please give me a push in the right direction?

Thank you and best regards,

Andrew

Re: Splunk Add-on for Microsoft Windows: How do I specify which index to send data to?

richgalloway — Thu, 19 May 2022 18:44:13 GMT

Specify the destination index in inputs.conf. Simply insert a new line in the appropriate stanza with index = followed by the name of index. See the examples at https://docs.splunk.com/Documentation/WindowsAddOn/8.1.2/User/Configuration#Configure_inputs.conf

Re: Splunk Add-on for Microsoft Windows: How do I specify which index to send data to?

andrewtrobec — Thu, 19 May 2022 20:28:38 GMT

@richgalloway thank you so much, I don't know how I didn't figure that out.

Re: Splunk Add-on for Microsoft Windows: How do I specify which index to send data to?

rosez2 — Mon, 13 Nov 2023 22:12:41 GMT

This worked for me when I was testing on a personal Windows laptop, but the official system I use is 2015 Windows 10 Pro, which is much older. I had to download an older 7.2.10 version of Splunk Universal Forwarder for it to even download. The logs are being forwarded, but when I add the index line, nothing changes and the search for that index comes up empty. Could this be due to using an older universal forwarder version? Is there a different way to assign an index?

Re: Splunk Add-on for Microsoft Windows: How do I specify which index to send data to?

richgalloway — Tue, 14 Nov 2023 13:16:08 GMT

This thread is over a year old with an accepted solution so the better way to get a response is to post a new question.

The old version s of Universal Forwarder support index names in inputs.conf exactly the same as newer versions. The index must exist on the indexers, of course, and you must have access to it.

Re: Splunk Add-on for Microsoft Windows: How do I specify which index to send data to?

rosez2 — Mon, 27 Nov 2023 22:28:35 GMT

I have the index in both the inputs.conf stanza, and I also added it to the Splunk Enterprise list of indexes. I don't understand why it worked on my Windows 10 Enterprise and my Kali Linux machines (for Kali I configured through command line), but not Windows 10 2015. I am sure that my steps for Windows 10 2015 and Windows 10 Enterprise are the exact same.

Re: Splunk Add-on for Microsoft Windows: How do I specify which index to send data to?

PickleRick — Tue, 28 Nov 2023 00:49:22 GMT

There might be several things wrong, not the destination index configuration. As @richgalloway already said - please create a new thread describing your configuration and problem. The problem in this thread has already been resolved. Let's keep the Answers nice and tidy 🙂